joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x2c], ecx
call fcn.0044b280
test eax, eax
je 0x44bb9d
movzx ecx, byte [esp + 0x64]
mov eax, 1
mov esi, eax
shl esi, cl
cmp dword [esp + 0x64], 3
jg 0x44bba5
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x44bb85
lea eax, [esi*4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
nop
lea esi, [esi]
test esi, esi
jle 0x44bce9
mov ecx, dword [esp + 0x2c]
xor edi, edi
xor eax, eax
mov ebx, dword [esp + 0x60]
add ecx, 4
mov ebp, dword [ecx - 4]
xor ebx, eax
add eax, 1
lea edx, [ebx - 1]
not ebx
and edx, ebx
sar edx, 0x1f
and edx, ebp
or edi, edx
cmp eax, esi
jne 0x44bb40
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 8]
add dword [esp + 8], 1
mov eax, dword [eax]
mov dword [eax + edx*4], edi
mov eax, dword [esp + 0xc]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x34]
jne 0x44bb30
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov dword [eax + 4], esi
mov dword [esp], eax
call fcn.0044b8d0
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x64]
lea ecx, [edx - 2]
shl eax, cl
mov ebx, eax
mov dword [esp + 0x10], eax
sub eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
and dword [esp + 0x14], eax
sar eax, cl
mov ecx, eax
mov edx, ecx
not edx
lea eax, [eax - 1]
and eax, edx
cdq
mov dword [esp + 0x18], edx
mov edx, ecx
xor edx, 1
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x1c], edx
mov edx, ecx
xor edx, 2
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x20], edx
mov edx, ecx
xor edx, 3
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x34]
test edx, edx
jle 0x44bb85
lea eax, [esi*4]
mov dword [esp + 0x3c], eax
mov eax, ebx
shl eax, 2
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
jle 0x44bcdf
lea esi, [esi]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edi, dword [esp + 0x28]
mov ebx, dword [edx]
mov ebp, dword [esp + 8]
xor ebp, dword [esp + 0x14]
lea ecx, [edx + edi]
add edx, 4
mov eax, dword [ecx]
add ecx, edi
mov esi, dword [ecx]
add ecx, edi
and eax, dword [esp + 0x1c]
and esi, dword [esp + 0x20]
and ebx, dword [esp + 0x18]
mov ecx, dword [ecx]
lea edi, [ebp - 1]
not ebp
and ecx, dword [esp + 0x24]
or eax, esi
and edi, ebp
or eax, ebx
sar edi, 0x1f
or eax, ecx
and edi, eax
mov eax, dword [esp + 0x10]
add dword [esp + 8], 1
or dword [esp + 0xc], edi
cmp dword [esp + 8], eax
jne 0x44bc54
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
add dword [esp + 0x30], 1
mov eax, dword [eax]
mov dword [eax + esi*4], edx
mov eax, dword [esp + 0x3c]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x44bb85
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x44bc40
mov dword [esp + 0xc], 0
jmp 0x44bca7
xor edi, edi
jmp 0x44bb61
Function at 0x44c600
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
test eax, eax
je 0x44c65e
xor edx, edx
xor eax, eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [ebx + edx*4]
mov ebx, dword [ebp + edx*4]
add edx, 1
mov dword [esp], esi
xor esi, ebx
mov edi, esi
not edi
lea ecx, [esi - 1]
and ecx, edi
mov edi, ecx
mov ecx, ebx
sub ecx, dword [esp]
sar edi, 0x1f
and eax, edi
xor ecx, ebx
or ecx, esi
xor ecx, ebx
mov ebx, edi
shr ecx, 0x1f
not ebx
and ecx, ebx
or eax, ecx
cmp edx, dword [esp + 0x20]
jne 0x44c617
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x44c656

Function at 0x44f700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], esi
mov edx, dword [eax]
cmp dword [eax + 4], 1
mov ebx, dword [edx]
mov dword [esp + 0x30], ebx
jle 0x44f72a
mov eax, dword [edx + 4]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x3c], 0x40
mov esi, 1
xor edi, edi
mov ecx, eax
mov ebx, edx
mov eax, esi
and eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
neg eax
mov dword [esp], eax
mov eax, dword [esp + 0x30]
adc edx, 0
mov ebp, dword [esp]
neg edx
mov dword [esp + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x20], 0
and ebp, eax
mov eax, dword [esp + 4]
mov ebx, ebp
and ebp, esi
xor ebx, esi
mov dword [esp + 0x18], ebx
and eax, edx
mov edx, dword [esp + 0x18]
mov ebx, eax
and eax, edi
xor ebx, edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebp
shrd edx, ecx, 1
shr ecx, 1
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x28]
add esi, dword [esp + 8]
adc edi, dword [esp + 0xc]
and eax, 0x80000000
mov dword [esp + 0x24], eax
shrd ecx, ebx, 1
shr ebx, 1
add ecx, dword [esp + 0x20]
adc ebx, dword [esp + 0x24]
sub dword [esp + 0x3c], 1
jne 0x44f741
add esp, 0x44
mov edx, ebx
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45e810
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x140]
mov ebp, dword [esp + 0x148]
test ebx, ebx
je 0x45e9dd
cmp ebx, dword [esi]
je 0x45e9df
cmp ebp, dword [ebx + 0x18]
ja 0x45e94f
test ebp, ebp
lea edi, [esp + 0xa0]
jne 0x45e9c1
mov dword [esp + 0x1c], ebp
cmp ebp, 0x80
je 0x45e880
mov eax, pe_nt_image_headers32
sub eax, ebp
add ebp, edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_memset
xor eax, eax
movzx ecx, byte [edi + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x45e882
mov eax, dword [esp + 0x150]
lea ebp, [esi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x45e8c2
add esp, 0x12c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x20]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov dword [esp], ebp
mov dword [esp + 8], ecx
call dword [eax + 0x10]
xor eax, eax
lea esi, [esi]
movzx ecx, byte [edi + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x45e8e0
mov eax, dword [esp + 0x150]
lea edi, [esi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x45e8b5
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x20]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 8], ecx
call dword [eax + 0x10]
mov dword [esi], ebx
add esi, 4
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_EVP_MD_CTX_copy_ex
test eax, eax
setne al
add esp, 0x12c
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x150]
lea ecx, [esi + 4]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
mov ecx, dword [esp + 0xc]
test eax, eax
je 0x45e8b5
mov eax, dword [esi + 4]
lea edi, [esp + 0xa0]
mov edx, dword [esp + 0x144]
mov dword [esp], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], edx
call dword [eax + 0x10]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ecx
call sym.adb.exe_EVP_DigestFinal_ex
test eax, eax
je 0x45e8b5
mov ebp, dword [esp + 0x1c]
jmp 0x45e85b
mov eax, dword [esp + 0x144]
mov dword [esp + 8], ebp
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
jmp 0x45e857
mov ebx, dword [esi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x45e83f
lea ebp, [esi + 0x14]
jmp 0x45e92d
Function at 0x45ec90
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x45ecf0
test edi, 2
jne 0x45ed00
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x45ecc1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x45ecc9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x45ecaa
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x45ecaa

Function at 0x45f8a0
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov edx, dword [esp + 0x84]
lea ebx, [esp + 0x14]
mov edi, ebx
mov esi, dword [esp + 0x88]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x67452301
test edx, edx
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
je 0x45f8f7
mov ecx, edx
mov edx, dword [esp + 0x80]
mov eax, ebx
call fcn.0045f4a0
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.adb.exe_MD4_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x45f910
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x45f970
test edi, 2
jne 0x45f980
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x45f941
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x45f949
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x45f92a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x45f92a

Function at 0x4607a0
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov edx, dword [esp + 0x84]
lea ebx, [esp + 0x14]
mov edi, ebx
mov esi, dword [esp + 0x88]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x67452301
test edx, edx
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
je 0x4607f7
mov ecx, edx
mov edx, dword [esp + 0x80]
mov eax, ebx
call fcn.00460360
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.adb.exe_MD5_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x460b10
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jne 0x460b50
mov dword [esp + 0x20], sym.adb.exe_AES_decrypt
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.00460930
mov dword [esp + 0x20], sym.adb.exe_AES_encrypt
pop ebx
pop esi
jmp fcn.00460810
Function at 0x461030
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [eax]
test edi, edi
je 0x46108b
mov eax, dword [esp + 0x38]
test eax, eax
je 0x46108b
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
jmp 0x461064
test ebp, ebp
je 0x46107f
movzx eax, byte [esi + edi]
add edx, 1
add edi, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and edi, 0xf
mov byte [ecx - 1], al
jne 0x461060
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebp
cmp dword [esp + 0x38], 0xf
jbe 0x461191
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x4610c3
mov edx, dword [esi + eax]
xor edx, dword [edi + eax]
mov dword [ebp + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x4610d6
sub dword [esp + 0xc], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0xc], 0xf
ja 0x4610a6
mov eax, dword [esp + 0x38]
xor edi, edi
mov ebp, dword [esp + 0x38]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x34], eax
add dword [esp + 0x30], eax
test ebp, ebp
jne 0x46112a
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x461147
mov ecx, dword [esp + 0x34]
lea ebx, [esi + edi]
mov esi, dword [esp + 0x30]
add ecx, edi
add esi, edi
lea esi, [esi]
movzx edx, byte [ebx + eax]
xor dl, byte [esi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x461170
add edi, eax
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x38]
jmp 0x461118
Function at 0x461c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x5c
lea ebx, [esp + 0x20]
lea ebp, [eax + 0xfc]
mov esi, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x108]
mov dword [esp + 4], esi
add esi, 0x10
mov dword [esp + 8], edi
mov dword [esp], ebp
bswap ecx
add ecx, 1
bswap ecx
mov dword [edi + 0x108], ecx
call dword [edi + 0xf4]
lea eax, [esp + 0x50]
cmp esi, eax
jne 0x461c2d
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x18]
test esi, esi
je 0x461c7e
lea esi, [esi]
movzx eax, byte [edx + ecx]
xor byte [ebx + ecx], al
add ecx, 1
cmp ecx, esi
jne 0x461c70
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], 0x100
call sym.adb.exe_AES_set_encrypt_key
mov eax, dword [esp + 0x40]
mov dword [edi + 0xf4], sym.adb.exe_AES_encrypt
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], eax
mov eax, dword [esp + 0x44]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x48]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [ebp + 0xc], eax
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x461ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov edi, dword [esp + 0x48]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x16c], 0
mov dword [ebp + 0x168], 0
je 0x461e55
mov eax, dword [esp + 0x4c]
xor edx, edx
mov ebx, edi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x461dd0
mov dword [esp + 0x48], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x14]
nop
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x461d92
mov dword [esp + 4], ebx
sub edi, 0x10
add esi, 0x10
mov dword [esp], ebp
call fcn.00448a20
cmp edi, 0xf
ja 0x461d90
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea edi, [edi + eax + 0x10]
mov ebx, dword [esp + 0x4c]
test ebx, ebx
je 0x461dff
mov ecx, dword [esp + 0x4c]
xor eax, eax
nop
movzx edx, byte [edi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, ecx
jne 0x461de0
mov eax, dword [esp + 0x14]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00448a20
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
xor dword [ebp + 0xc], eax
mov eax, dword [esp + 0x14]
xor dword [ebp + 8], edx
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00448a20
mov ebx, dword [ebp + 0xc]
bswap ebx
add ebx, 1
bswap ebx
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [ebp + 0x20]
mov dword [esp + 4], eax
call dword [ebp + 0x170]
mov dword [ebp + 0xc], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov ebx, 0x2000000
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
mov byte [ebp + 0xf], 1
mov dword [ebp + 8], eax
jmp 0x461e32
Function at 0x461fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x461fe5
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x461fed
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x4620e3
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x462053
test edi, edi
jne 0x462014
jmp 0x46202e
test edi, edi
je 0x46202a
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x462010
test edx, edx
je 0x462041
mov dword [esi + 0x16c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x60]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00448a20
cmp edi, 0xf
jbe 0x4620b6
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x60]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x462076
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00448a20
cmp ebx, 0xf
ja 0x462074
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x4620d0
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x4620c0
mov dword [esi + 0x16c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x461ff3
xor eax, eax
jmp 0x461fe5
Function at 0x463450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x40]
mov ebx, dword [eax]
test ebx, ebx
je 0x46349a
test edx, edx
je 0x46349a
mov edi, dword [esp + 0x30]
jmp 0x46347b
test edx, edx
je 0x463496
movzx eax, byte [esi + ebx]
add edi, 1
add ebx, 1
xor al, byte [edi - 1]
add ecx, 1
sub edx, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x463477
mov dword [esp + 0x30], edi
cmp edx, 0xf
jbe 0x463582
mov edi, dword [esp + 0x30]
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x38], edx
mov edx, esi
mov dword [esp + 0x34], ecx
mov esi, edi
mov edi, eax
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [esp + 0x48]
cmp ebx, 0xf
mov edx, dword [esp + 0xc]
ja 0x4634f2
mov eax, dword [edx + ebx]
xor eax, dword [esi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x4634e0
sub edi, 0x10
add ebp, 0x10
add esi, 0x10
cmp edi, 0xf
jbe 0x463504
xor ebx, ebx
jmp 0x4634c0
mov esi, edx
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edi, edx
sub edx, 0x10
and edx, 0xfffffff0
and edi, 0xf
lea eax, [edx + 0x10]
add dword [esp + 0x30], eax
add ecx, eax
test edi, edi
jne 0x463536
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], esi
add esi, ebx
mov dword [esp + 8], eax
call dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edx, dword [esp + 0x30]
add ecx, ebx
lea ebp, [edx + ebx]
nop
movzx edx, byte [esi + eax]
xor dl, byte [ebp + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, edi
jne 0x463560
add ebx, eax
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, edx
jmp 0x463524
Function at 0x463830
Capabilities:
Encode data using xor

Disassembly:
push edi
xor eax, eax
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x58]
mov ebx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
cmp esi, 0x30
ja 0x463945
mov eax, dword [edx]
test esi, esi
mov dword [esp + 0xc], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [edx + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [edx + 0x2c]
lea edx, [esp + 0xc]
mov dword [esp + 0x38], eax
je 0x4638c0
xor eax, eax
lea edx, [esp + 0xc]
movzx ecx, byte [edi + eax]
xor byte [edx + eax], cl
add eax, 1
cmp eax, esi
jne 0x4638b2
xor eax, eax
movzx ecx, byte [eax + 0x567d20]
xor byte [edx + eax], cl
add eax, 1
cmp eax, 0x30
jne 0x4638c2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x100
mov dword [esp], edx
call sym.adb.exe_AES_set_encrypt_key
cmp ebx, 0xffffff0c
je 0x4638fa
mov dword [ebx + 0xf4], sym.adb.exe_AES_encrypt
mov edx, dword [esp + 0x2c]
mov eax, 1
mov dword [ebx + 0xf8], 0
mov dword [ebx + 0x110], 1
mov dword [ebx + 0x114], 0
mov dword [ebx + 0xfc], edx
mov edx, dword [esp + 0x30]
mov dword [ebx + 0x100], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x104], edx
mov edx, dword [esp + 0x38]
mov dword [ebx + 0x108], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
ret

Function at 0x463950
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x38
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
test ecx, ecx
je 0x4639d1
cmp ecx, 0x30
ja 0x463a05
mov eax, dword [edx]
mov dword [esp], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [edx + 8]
mov dword [esp + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0x2c]
mov dword [esp + 0x2c], eax
xor eax, eax
movzx edx, byte [ebx + eax]
xor byte [esp + eax], dl
add eax, 1
cmp eax, ecx
jne 0x4639c1
mov edx, esp
mov eax, dword [esp + 0x40]
mov ecx, 0x30
call fcn.00461c10
test eax, eax
je 0x463a05
mov eax, dword [esp + 0x40]
mov dword [eax + 0x110], 1
mov dword [eax + 0x114], 0
add esp, 0x38
mov eax, 1
pop ebx
ret
add esp, 0x38
xor eax, eax
pop ebx
ret