joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61ebd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x61ec60
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.005b5620
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x61ec2f
sub eax, ebp
jmp 0x61ec31
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x61ec20
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x61ec50
sub eax, ebp
jmp 0x61ec52
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x61ec41
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x61ed8f
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
cmp ebx, edx
mov dword [esp + 0x10], eax
jbe 0x61ec88
mov ebx, edx
test ebx, ebx
je 0x61ecd9
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x61ecab
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00622290
jmp 0x61ecbd
cmp ecx, 2
jne 0x61ecc7
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.006208c0
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.005b5620
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x61ed03
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x61ed17
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x61ebe0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x61ed8f
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x61ed5e
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x61ed3e
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.005b4de0
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x61ed8f
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x61ed78
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.005b4de0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x625b7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x625baf
call fcn.005b788d
mov dword [eax], esi
call fcn.005b787a
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005b5b52
add esp, 0x14
push 0x16
pop eax
jmp 0x625c04
test dword [ebp + 0xc], 0xfffffff9
jne 0x625b8b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x625bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005b78a0
pop ecx
call fcn.005b787a
mov eax, dword [eax]
jmp 0x625c04
test al, 0x10
jne 0x625c02
test al, 1
je 0x625c02
test byte [ebp + 0xc], 2
je 0x625c02
call fcn.005b788d
mov dword [eax], 5
call fcn.005b787a
mov dword [eax], 0xd
jmp 0x625bd3
xor eax, eax
pop esi
pop ebp
ret

Function at 0x2d53700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d5378f
jae 0x2d5370e
xor ecx, ecx
call fcn.02d5378f
jae 0x2d5373d
xor eax, eax
call fcn.02d5378f
jae 0x2d5374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d5378f
adc al, al
jae 0x2d5372f
jne 0x2d53779
stosb byte es:[edi], al
jmp 0x2d53711
call fcn.02d5379b
sub ecx, ebx
jne 0x2d53756
call fcn.02d53799
jmp 0x2d53775
lodsb al, byte [esi]
shr eax, 1
je 0x2d53783
adc ecx, ecx
jmp 0x2d53772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d53799
cmp eax, 0x7d00
jae 0x2d53772
cmp ah, 5
jae 0x2d53773
cmp eax, 0x7f
ja 0x2d53774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d53711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x409d90
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
xor edx, edx
mov eax, dword [esi + 0x3c]
add eax, 0x20c
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov eax, dword [esi + 0x3c]
add eax, 0x264
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov ecx, dword [esi + 0x3c]
add ecx, 0x2c0
call fcn.00415e10
mov ecx, dword [esi + 0x3c]
mov edx, 1
add ecx, 0x330
pop esi
jmp fcn.00411160

Function at 0x40aa20
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
push 0x898
mov ebx, ecx
push 0
push ebx
call fcn.004d6720
push 0x58
lea esi, [ebx + 0x20c]
push 0
push esi
call fcn.004d6720
push 0x5c
lea edi, [ebx + 0x264]
push 0
push edi
call fcn.004d6720
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
lea esi, [ebx + 0x2c0]
push 0x6c
push 0
push esi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [edi + 0x18], 0xc3d2e1f0
call fcn.004d6720
xor edx, edx
mov ecx, esi
call fcn.00415e10
push 0xd8
push edx
lea esi, [ebx + 0x330]
push esi
call fcn.004d6720
mov edx, 1
mov ecx, esi
call fcn.00411160
push 0x1b0
lea eax, [ebx + 8]
mov dword [ebx + 0x408], 0x409e20
push 0
push eax
mov dword [ebx], 2
call fcn.004d6720
add esp, 0x48
mov dword [ebx + 0x1c8], 3
pop edi
pop esi
pop ebx
ret
Function at 0x40c480
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1c8
mov eax, dword [0x541a34]
xor eax, esp
mov dword [esp + 0x1c4], eax
cmp dword [0x546448], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
jne 0x40c4cd
lea eax, [esp + 0x38]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40c536
mov dword [0x546448], 1
mov ecx, dword [ebp + 0x14]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov edx, 0x11
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x14], 0
lea eax, [ecx - 1]
neg eax
sbb eax, eax
add eax, 2
cmp ecx, 1
mov dword [esp + 0x18], eax
mov eax, 6
cmove eax, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x40c54f
mov eax, 0xffffffae
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffbe
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 8]
mov edi, 0xffffffae
test esi, esi
je 0x40c5ad
nop dword [eax]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [esp + 0xc]
mov dword [edi], eax
test eax, eax
jns 0x40c580
mov edi, 0xffffffbe
jmp 0x40c59e
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40c5a7
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, 0xffffffbc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x40c560
jmp 0x40c5a9
xor edi, edi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x1cc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x40cbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x338
mov eax, dword [0x541a34]
xor eax, esp
mov dword [esp + 0x334], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
push esi
mov esi, edx
push edi
cmp eax, 0x180
jbe 0x40cc29
mov eax, 0xffffffc8
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [esp + 0x19c]
push 0
push eax
call fcn.004d6720
push 0x118
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004d6720
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x1c0], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x1c1], al
mov eax, ecx
shr eax, 8
push ecx
mov byte [esp + 0x1c6], al
lea eax, [esp + 0x1cc]
push esi
push eax
mov byte [esp + 0x1cf], cl
mov byte [esp + 0x1d3], 0x30
call fcn.004d61a0
mov eax, dword [esp + 0x30]
add esp, 0x24
lea esi, [eax + 0x19]
mov byte [esp + eax + 0x1b0], 0x80
mov dword [esp + 0x14], esi
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0x178], al
inc eax
cmp eax, 0x20
jl 0x40ccb0
push 0x100
lea edx, [esp + 0x17c]
lea ecx, [esp + 0x1c]
call fcn.00426ee0
mov cl, byte [esp + 0x19f]
add esp, 4
xor eax, eax
mov dword [esp + 0xc], eax
xorps xmm0, xmm0
mov edi, esi
movaps xmmword [esp + 0x130], xmm0
test esi, esi
je 0x40cd5c
lea esi, [esp + 0x198]
lea eax, [esp + 0x130]
sub esi, eax
xor eax, eax
lea edx, [esp + 0x130]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x40cd05
add esi, 0x10
mov eax, edi
cmp edi, 0x10
mov ecx, 0x10
cmovae eax, ecx
lea ecx, [esp + 0x18]
sub edi, eax
lea eax, [esp + 0x130]
push eax
mov edx, eax
call fcn.00427fb0
add esp, 4
test edi, edi
jne 0x40cd03
movaps xmm0, xmmword [esp + 0x130]
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0x19b]
mov esi, dword [esp + 0x14]
movups xmmword [esp + eax + 0x148], xmm0
add eax, 0x10
inc cl
mov byte [esp + 0x19b], cl
mov dword [esp + 0xc], eax
cmp eax, 0x30
jl 0x40cce2
push 0x100
lea edx, [esp + 0x14c]
lea ecx, [esp + 0x1c]
call fcn.00426ee0
add esp, 4
mov esi, 3
nop word [eax + eax]
lea eax, [esp + 0x168]
push eax
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.00427fb0
mov eax, dword [esp + 0x14]
add esp, 4
movups xmm0, xmmword [esp + 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [esp + 0x10], eax
sub esi, 1
jne 0x40cda0
mov eax, 0x118
lea ecx, [esp + 0x18]
nop word [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x40cde0
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x40ce00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
lea edi, [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, edi
mov dword [ebp - 0x38], ecx
push 0
push eax
call fcn.004d6720
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x40], eax
mov eax, ecx
add byte [eax], 1
jne 0x40ce52
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x40ce45
mov ecx, dword [ebp - 0x40]
push edi
call fcn.00427fb0
mov edx, dword [ebp - 0x38]
add esp, 4
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x40ce43
mov eax, dword [ebp - 0x3c]
mov edx, 0x20
movups xmm0, xmmword [ebp - 0x34]
pop edi
pop esi
movups xmm1, xmmword [eax]
pop ebx
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [ebp - 0x34], xmm1
movups xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ebp - 0x24], xmm1
mov al, byte [edx + eax]
xor byte [ebp + edx - 0x34], al
inc edx
mov eax, dword [ebp - 0x3c]
cmp edx, 0x30
jl 0x40ce96
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x34]
push 0x100
call fcn.00426ee0
mov ecx, dword [ebp - 0x38]
add esp, 4
movups xmm0, xmmword [ebp - 0x14]
xor eax, eax
movups xmmword [ecx], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x410520
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x520f80
mov edx, edi
test eax, eax
je 0x4105ba
cmp dword [0x520f80], 0
push ebx
push esi
je 0x4105a8
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x41059e
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x410569
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41056e
add edx, 4
add eax, 4
sub esi, 4
jae 0x410558
cmp esi, 0xfffffffc
je 0x4105b1
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41059b
cmp esi, 0xfffffffd
je 0x4105b1
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41059b
cmp esi, 0xfffffffe
je 0x4105b1
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41059b
cmp esi, 0xffffffff
je 0x4105b1
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4105b1
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x410547
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4105d0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x5210d0
mov edx, edi
test eax, eax
je 0x41066a
cmp dword [0x5210d0], 0
push ebx
push esi
je 0x410658
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x41064e
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x410619
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41061e
add edx, 4
add eax, 4
sub esi, 4
jae 0x410608
cmp esi, 0xfffffffc
je 0x410661
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41064b
cmp esi, 0xfffffffd
je 0x410661
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41064b
cmp esi, 0xfffffffe
je 0x410661
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41064b
cmp esi, 0xffffffff
je 0x410661
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x410661
mov eax, dword [ebp - 4]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x4105f7
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41c580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
push eax
push 0
push ebx
call fcn.004d6720
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x41c61b
movzx eax, byte [ebp + 8]
mov dword [ebp - 0xc], eax
xor edi, edi
test eax, eax
je 0x41c613
mov eax, dword [ebp + 0xc]
lea edx, [ecx + ebx]
mov bl, byte [edx]
mov esi, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 4]
shl eax, 5
mov dword [ebp - 0x14], eax
nop
cmp eax, esi
ja 0x41c5d8
xor eax, eax
jmp 0x41c5f0
mov eax, dword [ebp + 0xc]
mov edx, esi
shr edx, 5
mov ecx, esi
and ecx, 0x1f
mov eax, dword [eax + 8]
mov eax, dword [eax + edx*4]
shr eax, cl
and eax, 1
add esi, dword [ebp - 8]
mov ecx, edi
shl al, cl
inc edi
or bl, al
mov eax, dword [ebp - 0x14]
cmp edi, dword [ebp - 0xc]
jb 0x41c5d0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [eax], bl
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, esi
jb 0x41c5b2
mov edi, 1
xor al, al
cmp esi, edi
jb 0x41c669
mov bh, byte [edi + ebx]
mov bl, 1
mov ecx, dword [ebp - 4]
mov dh, bh
mov esi, dword [ebp - 4]
xor bh, al
and dh, al
mov al, bh
and al, 1
mov dl, byte [edi + ecx - 1]
sub bl, al
mov byte [edi + ecx], bh
movzx eax, bl
movzx ecx, dl
imul ecx, eax
shl bl, 7
or bl, dl
xor byte [edi + esi], cl
mov al, cl
mov ecx, esi
and al, bh
or al, dh
mov byte [edi + ecx - 1], bl
inc edi
mov ebx, ecx
cmp edi, dword [ebp - 8]
jbe 0x41c626
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426c80
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x426ca0
mov esi, 1
mov edx, 0x547fd8
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x548000
jl 0x426ce0
mov eax, 1
mov byte [0x548800], 0x63
mov byte [0x54673b], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
sar ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
sar ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
sar ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x548800], bl
mov byte [ebx + 0x5466d8], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x426d20
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x548800]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x5467d8], ecx
rol ecx, 8
mov dword [esi*4 + 0x546bd8], ecx
rol ecx, 8
mov dword [esi*4 + 0x546fd8], ecx
rol ecx, 8
mov dword [esi*4 + 0x5473d8], ecx
movzx ecx, byte [esi + 0x5466d8]
test ecx, ecx
je 0x426e60
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x426e6c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x5477d8], eax
rol eax, 8
mov dword [esi*4 + 0x547bd8], eax
rol eax, 8
mov dword [esi*4 + 0x548000], eax
rol eax, 8
mov dword [esi*4 + 0x548400], eax
inc esi
cmp esi, 0x100
jl 0x426da0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x427d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x541a34]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.004d6720
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.00426ee0
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x427f73
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x427f5d
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x548800]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x548400]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548000]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x547bd8]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x5477d8]
mov dword [edi], edx
movzx eax, byte [ecx + 4]
movzx edx, byte [eax + 0x548800]
movzx eax, byte [ecx + 7]
mov edx, dword [edx*4 + 0x5477d8]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548400]
movzx eax, byte [ecx + 6]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548000]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x547bd8]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 8]
movzx edx, byte [eax + 0x548800]
movzx eax, byte [ecx + 0xb]
mov edx, dword [edx*4 + 0x5477d8]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548400]
movzx eax, byte [ecx + 0xa]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548000]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x547bd8]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xc]
movzx edx, byte [eax + 0x548800]
movzx eax, byte [ecx + 0xf]
mov edx, dword [edx*4 + 0x5477d8]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548400]
movzx eax, byte [ecx + 0xe]
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x548000]
movzx eax, byte [ecx + 0xd]
sub ecx, 0x10
movzx eax, byte [eax + 0x548800]
xor edx, dword [eax*4 + 0x547bd8]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x427e20
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x427f80
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d219c
mov esp, ebp
pop ebp
ret