joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f5f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x45f604
push 0xd
pop eax
jmp 0x45f636
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x45f60d
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x45f800
Capabilities:
Get file version info

Disassembly:
push 0xc
mov eax, 0x5641bc
call fcn.0052eaed
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea esi, [ebx + 0x34]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push 0x34
push eax
mov dword [ebp - 4], eax
push ebx
mov byte [ebx + 0x40], al
call fcn.005278d0
add esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x45f886
push edi
mov ecx, esi
call fcn.00408ff8
push dword [esi]
push edi
push 0
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45f886
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x581774
push dword [esi]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45f886
mov esi, dword [ebp - 0x14]
mov edi, ebx
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x40], 1
mov eax, ebx
call fcn.0052eabb
ret 4

Function at 0x461a61
Capabilities:
Encode data using xor

Disassembly:
push 0xc
mov eax, 0x5644ea
call fcn.0052eaed
mov edi, edx
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
call fcn.0040adc1
push eax
lea ecx, [ebp - 0x10]
call fcn.0040a3a4
mov dword [ebp - 4], esi
test edi, edi
je 0x461af7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x461a90
sub ecx, edx
sar ecx, 1
test cl, 1
jne 0x461af7
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov ecx, edi
call fcn.00460b31
mov edi, eax
test edi, edi
je 0x461af7
cmp dword [ebp - 0x14], 0
mov dword [0x5b4ff8], 0x120
jbe 0x461ad1
xor byte [esi + edi], 0x73
inc esi
cmp esi, dword [ebp - 0x14]
jb 0x461ac7
push edi
call fcn.0041cdf6
pop ecx
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.0041cd7d
push edi
call fcn.0052558c
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
push esi
call fcn.0041c6b9
pop ecx
jmp 0x461b03
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
push esi
call fcn.0041c6b9
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [ebx], eax
call fcn.0040b4b1
mov eax, ebx
call fcn.0052eabb
ret
Function at 0x461d77
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x5a6c20
call fcn.00535f40
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x461dde
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x461dde
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x461dde
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x461dde
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x461de7
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.00535f85
ret

Function at 0x461eae
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x5bb3fc]
jmp 0x461ed0
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x461ebb
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x461f05
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x5bb3f4]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x5bb3fc]
test edx, edx
jne 0x461f53
test eax, eax
je 0x461f66
mov edx, eax
mov dword [0x5bb3f4], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x461f66
cmp ecx, ebx
jb 0x461f66
cmp ecx, edi
jbe 0x46203e
mov edx, eax
test eax, eax
jmp 0x461f88
test edx, edx
je 0x461f83
mov eax, dword [edx + 8]
test eax, eax
je 0x461f83
cmp eax, ebx
jb 0x461f83
cmp eax, edi
jbe 0x46203e
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x5bb3f4], edx
jne 0x461f6c
movzx eax, si
sub esi, eax
mov ecx, esi
cmp esi, ebx
jbe 0x4620de
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4620de
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x461fd9
cmp dword [ebp - 0x30], eax
jae 0x461feb
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x461f9f
jmp 0x4620de
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x5bb3f4], edx
test edx, edx
je 0x4620de
mov eax, dword [0x5bb3fc]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x5bb3fc], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec esi
jne 0x462030
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x4620e2
cmp esi, edi
ja 0x4620e2
mov ecx, dword [esi + 0x18]
mov eax, 0xcccccccc
mov dword [edx + 8], ecx
mov edi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, esi
jmp 0x4620e4
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4620e2
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x4620d6
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x4620d9
movzx edx, si
test edx, edx
je 0x4620b7
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x5bb3f4], edx
test edx, edx
jne 0x46200c
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x462067
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4621d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5bb404], eax
je 0x4621ec
mov eax, 0x10dd
jmp 0x462274
push ebx
push esi
push edi
mov edi, dword [0x5bb3f8]
xor ebx, ebx
test edi, edi
je 0x462236
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x462227
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x462227
call fcn.004620eb
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.0052558c
mov edi, esi
pop ecx
test esi, esi
jne 0x4621fb
mov dword [0x5bb3f8], ebx
call fcn.00461ed9
mov edi, dword [0x5bb3f0]
test edi, edi
je 0x462263
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.0052558c
mov edi, esi
pop ecx
test esi, esi
jne 0x46224b
pop edi
pop esi
mov dword [0x5bb3f0], ebx
xor eax, eax
mov dword [0x5bb404], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46277d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5bb404], eax
je 0x4627a0
mov eax, 0x10dd
jmp 0x46287d
mov eax, dword [0x5bb400]
test eax, eax
jne 0x46287d
test ebx, ebx
jne 0x4627b9
push 6
pop eax
jmp 0x46287d
cmp dword [ebx], 0
jne 0x4627d1
push 6
pop eax
mov dword [0x5bb400], eax
mov dword [0x5bb3ec], ebx
jmp 0x46287d
push esi
push edi
push 0x18
call fcn.0041285f
mov esi, eax
pop ecx
test esi, esi
jne 0x4627e6
push 8
pop edi
jmp 0x462862
mov ecx, dword [ebp - 8]
mov edi, dword [ebx]
call fcn.00461e1d
movzx ecx, byte [edi + 0x17]
mov edx, eax
mov eax, dword [edi + 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x462856
cmp ecx, 0x17
ja 0x462856
cmp dword [edi + 0x1c], edx
jne 0x462856
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x46282c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x462862
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x5bb3f8]
mov dword [esi], eax
xor eax, eax
mov dword [0x5bb3f8], esi
jmp 0x46287b
cmp dword [0x5bb408], 0
push 9
pop edi
jne 0x462868
mov dword [0x5bb400], edi
test esi, esi
je 0x462873
push esi
call fcn.0052558c
pop ecx
mov dword [0x5bb3ec], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ceaf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
xor eax, eax
push esi
mov esi, edx
mov dword [ebp - 4], eax
push edi
mov edx, dword [ebx + 0x3c]
mov dword [ebp - 8], esi
cmp dword [edx], eax
jne 0x46cedf
push dword [ebx + 0x78]
call fcn.0046ca82
mov dword [ebp - 4], eax
pop ecx
test eax, eax
jne 0x46cfc3
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x46cf16
mov eax, dword [ebx + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.00531b50
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x18]
push edx
push 5
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 4]
test esi, esi
je 0x46cfc3
mov edi, dword [esi + 0x14]
mov dword [ebp - 0x14], edi
cmp edi, dword [ebx + 0x18]
ja 0x46cfb5
test byte [esi + 0x18], 0x20
jne 0x46cfb5
mov eax, dword [ebx + 0x80]
lea ecx, [edi - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.00531b50
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
cmp edi, 1
jne 0x46cf5c
mov ecx, esi
call fcn.0046c524
push dword [ebp - 4]
mov eax, dword [esi + 4]
mov edx, eax
push dword [ebp - 0xc]
mov ecx, dword [ebx + 0x3c]
push dword [ebx + 0x80]
mov dword [ebp - 0x10], eax
call fcn.00464150
add esp, 0xc
mov dword [ebp - 4], eax
cmp edi, 1
jne 0x46cf96
mov esi, dword [ebp - 0x10]
lea edi, [ebx + 0x64]
add esi, 0x18
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x14]
cmp edi, dword [ebx + 0x20]
jbe 0x46cf9e
mov dword [ebx + 0x20], edi
inc dword [ebx + 0xa8]
mov edx, edi
push dword [esi + 4]
mov ecx, dword [ebx + 0x58]
call fcn.00477b63
mov eax, dword [ebp - 4]
pop ecx
mov esi, dword [esi + 0xc]
mov dword [ebp - 8], esi
test eax, eax
je 0x46cf19
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a86f9
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b38f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0x10
pop edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x11c], ecx
cmp edi, edx
je 0x4a8735
cmp edi, 0xc
je 0x4a8735
cmp edi, 8
cmovne edi, edx
mov dword [ebp + 0xc], edi
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], edi
mov esi, ebx
lea ecx, [eax - 8]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
test ecx, ecx
js 0x4a87cb
lea eax, [ecx + 8]
shr eax, 3
mov dword [ebp - 0x114], eax
mov edi, eax
shl eax, 3
mov dword [ebp - 0x10c], eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp + esi*4 - 0x104], ecx
movzx ecx, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add edx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x100], ecx
add esi, 2
dec edi
jne 0x4a8768
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], esi
sub eax, dword [ebp - 0x10c]
je 0x4a8841
mov eax, dword [ebp - 0x108]
mov ecx, ebx
and eax, 7
mov esi, ebx
add edx, eax
dec eax
cmp eax, 7
ja case.default.0x4a87e8
jmp dword [eax*4 + 0x4a8925]
dec edx
movzx ecx, byte [edx]
shl ecx, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
movzx esi, byte [edx]
shl esi, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or esi, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or esi, eax
movzx eax, byte [edx - 1]
or esi, eax
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x104], esi
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x108]
lea edi, [edi*2 + 2]
add eax, 3
xor ecx, ecx
cdq
inc ecx
and edx, 3
lea esi, [edx + eax]
mov edx, dword [ebp - 0x11c]
sar esi, 2
mov dword [edx + 4], 0xb7e15163
cmp edi, ecx
jle 0x4a8880
mov eax, dword [edx + ecx*4]
sub eax, 0x61c88647
mov dword [edx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x4a886f
cmp edi, esi
mov dword [ebp - 0x108], ebx
mov eax, esi
mov ecx, ebx
cmovg eax, edi
imul eax, eax, 3
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], eax
jle 0x4a8912
add ecx, dword [ebp - 0x108]
add ecx, dword [edx + eax*4 + 4]
rol ecx, 3
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp + ebx*4 - 0x104]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], ecx
add ecx, dword [ebp - 0x108]
add eax, dword [ebp - 0x114]
and ecx, 0x1f
rol eax, cl
xor ecx, ecx
mov dword [ebp + ebx*4 - 0x104], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
cmp eax, edi
cmovge eax, ecx
inc ebx
cmp ebx, esi
mov dword [ebp - 0x110], eax
cmovge ebx, ecx
dec dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
jne 0x4a88a8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b1ec
mov esp, ebp
pop ebp
ret
Function at 0x4a87ef
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b38f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0x10
pop edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x11c], ecx
cmp edi, edx
je 0x4a8735
cmp edi, 0xc
je 0x4a8735
cmp edi, 8
cmovne edi, edx
mov dword [ebp + 0xc], edi
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], edi
mov esi, ebx
lea ecx, [eax - 8]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
test ecx, ecx
js 0x4a87cb
lea eax, [ecx + 8]
shr eax, 3
mov dword [ebp - 0x114], eax
mov edi, eax
shl eax, 3
mov dword [ebp - 0x10c], eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp + esi*4 - 0x104], ecx
movzx ecx, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add edx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x100], ecx
add esi, 2
dec edi
jne 0x4a8768
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], esi
sub eax, dword [ebp - 0x10c]
je 0x4a8841
mov eax, dword [ebp - 0x108]
mov ecx, ebx
and eax, 7
mov esi, ebx
add edx, eax
dec eax
cmp eax, 7
ja case.default.0x4a87e8
jmp dword [eax*4 + 0x4a8925]
dec edx
movzx ecx, byte [edx]
shl ecx, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
movzx esi, byte [edx]
shl esi, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or esi, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or esi, eax
movzx eax, byte [edx - 1]
or esi, eax
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x104], esi
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x108]
lea edi, [edi*2 + 2]
add eax, 3
xor ecx, ecx
cdq
inc ecx
and edx, 3
lea esi, [edx + eax]
mov edx, dword [ebp - 0x11c]
sar esi, 2
mov dword [edx + 4], 0xb7e15163
cmp edi, ecx
jle 0x4a8880
mov eax, dword [edx + ecx*4]
sub eax, 0x61c88647
mov dword [edx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x4a886f
cmp edi, esi
mov dword [ebp - 0x108], ebx
mov eax, esi
mov ecx, ebx
cmovg eax, edi
imul eax, eax, 3
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], eax
jle 0x4a8912
add ecx, dword [ebp - 0x108]
add ecx, dword [edx + eax*4 + 4]
rol ecx, 3
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp + ebx*4 - 0x104]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], ecx
add ecx, dword [ebp - 0x108]
add eax, dword [ebp - 0x114]
and ecx, 0x1f
rol eax, cl
xor ecx, ecx
mov dword [ebp + ebx*4 - 0x104], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
cmp eax, edi
cmovge eax, ecx
inc ebx
cmp ebx, esi
mov dword [ebp - 0x110], eax
cmovge ebx, ecx
dec dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
jne 0x4a88a8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b1ec
mov esp, ebp
pop ebp
ret
Function at 0x4a87f6
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b38f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0x10
pop edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x11c], ecx
cmp edi, edx
je 0x4a8735
cmp edi, 0xc
je 0x4a8735
cmp edi, 8
cmovne edi, edx
mov dword [ebp + 0xc], edi
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], edi
mov esi, ebx
lea ecx, [eax - 8]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
test ecx, ecx
js 0x4a87cb
lea eax, [ecx + 8]
shr eax, 3
mov dword [ebp - 0x114], eax
mov edi, eax
shl eax, 3
mov dword [ebp - 0x10c], eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp + esi*4 - 0x104], ecx
movzx ecx, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add edx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x100], ecx
add esi, 2
dec edi
jne 0x4a8768
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], esi
sub eax, dword [ebp - 0x10c]
je 0x4a8841
mov eax, dword [ebp - 0x108]
mov ecx, ebx
and eax, 7
mov esi, ebx
add edx, eax
dec eax
cmp eax, 7
ja case.default.0x4a87e8
jmp dword [eax*4 + 0x4a8925]
dec edx
movzx ecx, byte [edx]
shl ecx, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
movzx esi, byte [edx]
shl esi, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or esi, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or esi, eax
movzx eax, byte [edx - 1]
or esi, eax
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x104], esi
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x108]
lea edi, [edi*2 + 2]
add eax, 3
xor ecx, ecx
cdq
inc ecx
and edx, 3
lea esi, [edx + eax]
mov edx, dword [ebp - 0x11c]
sar esi, 2
mov dword [edx + 4], 0xb7e15163
cmp edi, ecx
jle 0x4a8880
mov eax, dword [edx + ecx*4]
sub eax, 0x61c88647
mov dword [edx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x4a886f
cmp edi, esi
mov dword [ebp - 0x108], ebx
mov eax, esi
mov ecx, ebx
cmovg eax, edi
imul eax, eax, 3
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], eax
jle 0x4a8912
add ecx, dword [ebp - 0x108]
add ecx, dword [edx + eax*4 + 4]
rol ecx, 3
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp + ebx*4 - 0x104]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], ecx
add ecx, dword [ebp - 0x108]
add eax, dword [ebp - 0x114]
and ecx, 0x1f
rol eax, cl
xor ecx, ecx
mov dword [ebp + ebx*4 - 0x104], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
cmp eax, edi
cmovge eax, ecx
inc ebx
cmp ebx, esi
mov dword [ebp - 0x110], eax
cmovge ebx, ecx
dec dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
jne 0x4a88a8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b1ec
mov esp, ebp
pop ebp
ret
Function at 0x4a87ff
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b38f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0x10
pop edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x11c], ecx
cmp edi, edx
je 0x4a8735
cmp edi, 0xc
je 0x4a8735
cmp edi, 8
cmovne edi, edx
mov dword [ebp + 0xc], edi
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], edi
mov esi, ebx
lea ecx, [eax - 8]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
test ecx, ecx
js 0x4a87cb
lea eax, [ecx + 8]
shr eax, 3
mov dword [ebp - 0x114], eax
mov edi, eax
shl eax, 3
mov dword [ebp - 0x10c], eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp + esi*4 - 0x104], ecx
movzx ecx, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add edx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x100], ecx
add esi, 2
dec edi
jne 0x4a8768
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], esi
sub eax, dword [ebp - 0x10c]
je 0x4a8841
mov eax, dword [ebp - 0x108]
mov ecx, ebx
and eax, 7
mov esi, ebx
add edx, eax
dec eax
cmp eax, 7
ja case.default.0x4a87e8
jmp dword [eax*4 + 0x4a8925]
dec edx
movzx ecx, byte [edx]
shl ecx, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
movzx esi, byte [edx]
shl esi, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or esi, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or esi, eax
movzx eax, byte [edx - 1]
or esi, eax
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x104], esi
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x108]
lea edi, [edi*2 + 2]
add eax, 3
xor ecx, ecx
cdq
inc ecx
and edx, 3
lea esi, [edx + eax]
mov edx, dword [ebp - 0x11c]
sar esi, 2
mov dword [edx + 4], 0xb7e15163
cmp edi, ecx
jle 0x4a8880
mov eax, dword [edx + ecx*4]
sub eax, 0x61c88647
mov dword [edx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x4a886f
cmp edi, esi
mov dword [ebp - 0x108], ebx
mov eax, esi
mov ecx, ebx
cmovg eax, edi
imul eax, eax, 3
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], eax
jle 0x4a8912
add ecx, dword [ebp - 0x108]
add ecx, dword [edx + eax*4 + 4]
rol ecx, 3
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp + ebx*4 - 0x104]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], ecx
add ecx, dword [ebp - 0x108]
add eax, dword [ebp - 0x114]
and ecx, 0x1f
rol eax, cl
xor ecx, ecx
mov dword [ebp + ebx*4 - 0x104], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
cmp eax, edi
cmovge eax, ecx
inc ebx
cmp ebx, esi
mov dword [ebp - 0x110], eax
cmovge ebx, ecx
dec dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
jne 0x4a88a8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b1ec
mov esp, ebp
pop ebp
ret