joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49da90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [ebp - 0x34], 0x10
mov dword [ebp - 0x30], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x49dc61
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [ebp - 0x24], xmm0
mov word [ebp - 0x2c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x28], eax
xor eax, eax
push 4
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x30]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x49dc4f
push 0x10
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x49dc4f
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x49dc4f
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x49dc4f
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x49dc4f
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x49dc4f
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x49dc4f
push ebx
push 0x545c80
lea eax, [ebp - 0x1c]
push 0xc
push eax
call fcn.00494e40
lea esi, [ebp - 0x1c]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x49dbb6
push 0
sub esi, ecx
lea eax, [ebp - 0x1c]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x49dc4f
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x49dc4f
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x10]
sub esi, 4
jb 0x49dc03
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x49dc08
add ecx, 4
add edx, 4
sub esi, 4
jae 0x49dbf2
cmp esi, 0xfffffffc
je 0x49dc35
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x49dc4f
cmp esi, 0xfffffffd
je 0x49dc35
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x49dc4f
cmp esi, 0xfffffffe
je 0x49dc35
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x49dc4f
cmp esi, 0xffffffff
je 0x49dc35
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x49dc4f
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4a27b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4a2944
push edi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x4a2930
push esi
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4a27ff
mov eax, 0x10
jmp 0x4a280d
cmp eax, 0x17
jne 0x4a28c1
mov eax, 0x1c
cmp dword [edi + 0x18], 0
mov dword [ebp - 4], eax
je 0x4a28c1
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4a28c1
cmp ecx, eax
jb 0x4a28c1
push 0x20
call dword [0x599144]
mov esi, eax
add esp, 4
test esi, esi
je 0x4a2925
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x599144]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4a2914
push dword [ebp - 4]
push dword [edi + 0x18]
push eax
call fcn.00504640
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4a28af
push eax
call dword [0x599150]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4a28fa
mov eax, dword [ebp - 8]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x4a28be
mov dword [eax + 0x1c], esi
mov dword [ebp - 8], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4a27f0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop esi
test eax, eax
je 0x4a28de
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x4a292c
push ebx
call fcn.004a2770
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x599148]
push esi
call dword [0x599148]
add esp, 8
jmp 0x4a28cf
push esi
mov edi, 8
call dword [0x599148]
add esp, 4
jmp 0x4a28cf
mov edi, 8
jmp 0x4a28cf
test ebx, ebx
jne 0x4a293c
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2ce0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0050d0fd
add esp, 0x18
test eax, eax
je 0x4a2d02
cmp eax, 0xffffffff
jne 0x4a2d04
xor eax, eax
pop ebp
ret
Function at 0x4a3530
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push esi
push 0
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp + 0x14], esi
call fcn.00504e30
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push dword [ebp + 0x18]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4a35fe
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4a35e0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4a35e0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4a35e0
cmp esi, dword [ebp - 0xc]
jb 0x4a35e0
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a35ee
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4a35fe
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a6890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004ff770
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005167dd
add esp, 4
mov byte [ebp - 0x1004], 0
test eax, eax
je 0x4a68f8
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x1004], 0
je 0x4a68f8
lea eax, [ebp - 0x1004]
push eax
call dword [0x599150]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4b2750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], ebx
push eax
push 0x10
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.004b2fa0
add esp, 0x14
test eax, eax
jne 0x4b293b
movzx eax, byte [ebp - 0x13]
xor edx, edx
movzx ecx, byte [ebp - 0x10]
push esi
movzx esi, byte [ebp - 0x14]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x12]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc0], 0
movzx eax, byte [ebp - 0x11]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc4], 0
movzx eax, byte [ebp - 0xf]
or ecx, eax
mov dword [ebx + 0x104], esi
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x40], 0
movzx eax, byte [ebp - 0xd]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x44], 0
movzx eax, byte [ebp - 0xb]
or edx, ecx
movzx ecx, byte [ebp - 8]
push edi
movzx edi, byte [ebp - 0xc]
shl edi, 8
or edi, eax
shl ecx, 8
movzx eax, byte [ebp - 0xa]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 9]
xor edx, edx
shl edi, 8
or edi, eax
mov dword [ebp - 0x20], 4
movzx eax, byte [ebp - 7]
or ecx, eax
mov dword [ebx + 0x84], edi
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
or edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x100], ecx
shrd dword [ebp - 0x18], edi, 1
shl ecx, 0x1f
and edx, 1
shr edi, 1
xor eax, eax
or dword [ebp - 0x18], eax
or edi, ecx
mov ecx, dword [ebp - 0x1c]
shrd ecx, esi, 1
imul edx, edx, 0xe1000000
xor ecx, eax
shr esi, 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebx + eax*8 + 0x40], edx
mov dword [ebx + eax*8 + 0x44], edi
mov dword [ebx + eax*8 + 0xc0], ecx
mov dword [ebx + eax*8 + 0xc4], esi
sar eax, 1
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x4b2861
mov ecx, 2
mov dword [ebp - 0x20], ecx
nop dword [eax + eax]
lea edi, [ecx + 0x18]
mov eax, dword [ebx + edi*8]
lea edi, [ebx + edi*8]
mov dword [ebp - 0x1c], eax
lea edx, [ecx + 8]
mov eax, dword [edi + 4]
lea edx, [ebx + edx*8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp ecx, 1
jle 0x4b292d
lea eax, [ebx + 0x48]
sub edi, edx
lea esi, [edx + 8]
lea ebx, [ecx - 1]
mov edx, dword [eax + 0x80]
lea eax, [eax + 8]
mov ecx, dword [eax + 0x7c]
lea esi, [esi + 8]
xor edx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [edi + esi - 8], edx
mov dword [edi + esi - 4], ecx
mov edx, dword [eax - 8]
mov ecx, dword [eax - 4]
xor edx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x2c]
mov dword [esi - 8], edx
mov dword [esi - 4], ecx
sub ebx, 1
jne 0x4b28f3
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jle 0x4b28c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4b3640
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [edx + 0x18]
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
pop ebp
ret
Function at 0x4b3780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x4b37da
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, edx
mov esi, dword [edi + 0x80]
mov dword [ebp + 0xc], eax
nop dword [eax]
cmp esi, 0x40
jae 0x4b37d4
mov al, byte [eax + edx]
inc ecx
xor al, byte [esi + edi + 0x40]
mov byte [edx], al
inc edx
inc dword [edi + 0x80]
mov esi, dword [edi + 0x80]
mov eax, dword [ebp + 0xc]
sub ebx, 1
jne 0x4b37b0
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ebx
cmp ebx, 0x40
jb 0x4b3899
lea eax, [edi + 0x41]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov edx, eax
sub edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], edx
lea esi, [eax + 2]
mov eax, ebx
add esi, ecx
shr eax, 6
mov dword [ebp - 8], eax
lea eax, [edi + 0x40]
push eax
push edi
call fcn.004b3300
inc dword [edi + 0x30]
add esp, 8
mov eax, dword [ebp - 4]
mov edi, 8
mov edx, dword [ebp - 0xc]
add eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
movzx ecx, byte [eax + ebx]
lea eax, [eax + 8]
xor cl, byte [edx - 1]
lea edx, [edx + 8]
mov byte [eax - 8], cl
movzx ecx, byte [esi - 1]
xor cl, byte [edx - 8]
mov byte [eax - 7], cl
movzx ecx, byte [edx - 7]
xor cl, byte [esi]
mov byte [eax - 6], cl
movzx ecx, byte [edx - 6]
xor cl, byte [esi + 1]
mov byte [eax - 5], cl
movzx ecx, byte [edx - 5]
xor cl, byte [esi + 2]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor cl, byte [esi + 3]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor cl, byte [esi + 4]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 2]
xor cl, byte [esi + 5]
add esi, 8
mov byte [eax - 1], cl
sub edi, 1
jne 0x4b3822
mov ebx, dword [ebp + 0xc]
add dword [ebp - 4], 0x40
sub ebx, 0x40
sub dword [ebp - 8], 1
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
jne 0x4b3801
test ebx, ebx
je 0x4b38dc
lea esi, [edi + 0x40]
push esi
push edi
call fcn.004b3300
inc dword [edi + 0x30]
add esp, 8
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov edi, dword [ebp - 4]
sub dword [ebp + 0x10], ecx
add edi, ecx
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + edx]
mov al, byte [eax + ecx]
xor al, byte [esi + edx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4b38c0
mov edi, dword [ebp + 8]
mov dword [edi + 0x80], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b3a20
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b3640
Function at 0x4b46d0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x4b46f0
mov esi, 1
mov edx, 0x5a2e50
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x5a2e78
jl 0x4b4730
mov eax, 1
mov byte [0x5a0c50], 0x63
mov byte [0x5a1db3], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x5a0c50], bl
mov byte [ebx + 0x5a1d50], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4b4770
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x5a0c50]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x5a0d50], ecx
rol ecx, 8
mov dword [esi*4 + 0x5a1150], ecx
rol ecx, 8
mov dword [esi*4 + 0x5a1550], ecx
rol ecx, 8
mov dword [esi*4 + 0x5a1950], ecx
movzx ecx, byte [esi + 0x5a1d50]
test ecx, ecx
je 0x4b48b0
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x4b48bc
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x5a1e50], eax
rol eax, 8
mov dword [esi*4 + 0x5a2250], eax
rol eax, 8
mov dword [esi*4 + 0x5a2650], eax
rol eax, 8
mov dword [esi*4 + 0x5a2a50], eax
inc esi
cmp esi, 0x100
jl 0x4b47f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4b50a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x118
push 0
push eax
call fcn.00504e30
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push esi
lea edi, [ebx + 8]
push eax
mov dword [ebx + 4], edi
call fcn.004b52e0
add esp, 0x18
mov dword [ebp - 0x120], eax
test eax, eax
jne 0x4b52a0
mov ecx, dword [ebp - 0x11c]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [ebp - 0x118]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x4b528a
nop
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x5a0c50]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x5a2a50]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2650]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2250]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a1e50]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5a0c50]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5a2650]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2250]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2a50]
movzx eax, bl
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a1e50]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5a0c50]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5a2650]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2250]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2a50]
movzx eax, bl
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a1e50]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5a0c50]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5a2650]
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2250]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a2a50]
movzx eax, bl
movzx eax, byte [eax + 0x5a0c50]
xor edx, dword [eax*4 + 0x5a1e50]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x4b5130
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x11c]
push 0x118
push eax
call fcn.004b2d80
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x120]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4b73f0
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x54d2c8]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + 0x54d1c8]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x54d3c8]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x54d0c8]
or esi, eax
mov eax, ebx
shr eax, 0x10
mov edx, esi
movzx eax, al
rol edx, 8
movzx ecx, byte [eax + 0x54d1c8]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x54d0c8]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x54d2c8]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x54d3c8]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret