joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4453a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4454c5
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4453b3
sub edi, ecx
sar edi, 1
je 0x4454c5
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4453d9
pop edi
pop esi
ret 4
push ebx
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x445422
push ebx
call ebp
test eax, eax
je 0x445422
lea ecx, [edi + 1]
push ecx
push eax
push esi
call fcn.00491720
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x445477
push ebx
call ebp
mov ebp, eax
test ebp, ebp
je 0x445471
lea ecx, [edi + 1]
push ecx
push ebp
push esi
call fcn.00491720
push ebp
push ebp
call dword [sym.imp.USER32.dll_CharToOemA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
push 7
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x44547d
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4454bd
push edi
call ebp
mov ecx, eax
test ecx, ecx
je 0x4454bd
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4454a1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x445bb0
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, ecx
call fcn.0046bee0
cmp eax, 0x600
jb 0x445bd1
mov ecx, dword [ebx]
movzx eax, byte [esp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x10]
pop ebx
ret 4
mov ecx, dword [ebx + 8]
mov al, byte [esp + 8]
mov byte [ecx + 0x64], al
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x445c4d
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea esi, [eax + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ebd1f
add esp, 4
mov edi, eax
push esi
push edi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebx + 0xc]
call esi
push 1
push 8
push 0x102
push dword [ebx + 0xc]
call esi
push edi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call fcn.004ebd28
add esp, 4
pop edi
pop esi
pop ebx
ret 4
Function at 0x447ad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x268
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push esi
mov esi, dword [esp + 0x278]
lea eax, [esp + 0x16c]
push edi
push 0x80
push 0x50b8c4
push eax
push 0x50f414
push dword [0x525f94]
call fcn.0049fec0
cmp word [esp + 0x170], 0
lea eax, [esp + 0x170]
push 0x100
push eax
setne bl
call fcn.0048bcb0
mov edi, dword [esp + 0x278]
lea eax, [esp + 0xc]
push edi
test bl, bl
je 0x447b7a
push 0x50f41c
push 0x32
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esp + 0xc]
push 0x80
push 0x50b8c4
push esi
push eax
push dword [0x525f94]
call fcn.0049fec0
cmp word [esi], 0
jne 0x447bfa
xor al, al
jmp 0x447cb5
push str.PE_d
push 0x32
push eax
call fcn.004028e0
push 0x100
lea eax, [esp + 0x84]
push 0
push eax
call fcn.004ee100
add esp, 0x1c
lea eax, [esp + 0x70]
push 0x100
push 0
push eax
lea eax, [esp + 0x18]
push eax
push dword [0x525f94]
call fcn.0049fd50
mov edx, eax
test edx, edx
je 0x447b73
xor ecx, ecx
test edx, edx
jle 0x447bd2
lea eax, [ecx + 0x49]
xor byte [esp + ecx + 0x70], al
inc ecx
cmp ecx, edx
jl 0x447bc6
push 0x80
push esi
lea eax, [esp + 0x78]
push eax
call fcn.00491530
xor eax, eax
mov word [esi + 0xfe], ax
lea eax, [esp + 0x70]
push 0x100
push eax
call fcn.0048bcb0
push edi
push 0x50f430
lea eax, [esp + 0x14]
push 0x32
push eax
call fcn.004028e0
add esp, 0x10
lea ebx, [esi + 0x100]
lea eax, [esp + 0xc]
push 0xc8
push 0x50b8c4
push ebx
push eax
push dword [0x525f94]
call fcn.0049fec0
push edi
push 0x50f438
lea eax, [esp + 0x14]
push 0x32
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esi + 0x290]
push 0x800
push 0x50b8c4
push eax
lea eax, [esp + 0x18]
push eax
push dword [0x525f94]
call fcn.0049fec0
push edi
push 0x50f440
lea eax, [esp + 0x14]
push 0x32
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esp + 0xc]
push 0
push eax
push dword [0x525f94]
call fcn.0049fd30
test eax, eax
push 0xc8
setne al
cmp word [ebx], 0
mov byte [esi + 0x1420], al
lea eax, [esi + 0x1290]
je 0x447cac
push ebx
jmp 0x447cad
push esi
push eax
call fcn.0048e710
mov al, 1
mov ecx, dword [esp + 0x270]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x268
ret 8
Function at 0x450610
Capabilities:
Check if file exists

Disassembly:
mov byte [ecx + 0x3320], 0
jmp fcn.00468010
Function at 0x457fd0
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x5781c4], 2
jl 0x457ff5
movaps xmm0, xmmword [0x50f650]
movaps xmmword [0x5650d0], xmm0
movaps xmm0, xmmword [0x50f640]
movaps xmmword [0x5650e0], xmm0
push esi
mov esi, dword [esp + 8]
push 0xf0
push 0
push esi
call fcn.004ee100
mov dword [esi + 0x100], 0
add esp, 0xc
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov eax, dword [esi + 0xf4]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi + 0xf4]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x458260
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x200
push 0
lea eax, [edi + 0x948]
push eax
call fcn.004ee100
add esp, 0xc
mov dword [edi + 0xb48], 0
lea eax, [edi + 0x840]
push 1
push 0
push eax
call fcn.00457fd0
mov dword [esp + 0xc], 0
lea esi, [edi + 0xf4]
cmp dword [0x5781c4], 2
jl 0x4582c9
movaps xmm0, xmmword [0x50f650]
movaps xmmword [0x5650d0], xmm0
movaps xmm0, xmmword [0x50f640]
movaps xmmword [0x5650e0], xmm0
push 0xf0
lea eax, [esi - 0xf4]
push 0
push eax
call fcn.004ee100
mov dword [esi + 0xc], 0
add esp, 0xc
mov byte [esi + 0x10], 0
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
mov dword [eax], 0x6a09e667
mov eax, dword [esi]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [esi]
xor dword [eax], 0x2080020
mov eax, dword [esi]
xor dword [eax + 8], ecx
inc ecx
mov eax, dword [esi]
add esi, 0x108
mov dword [esp + 0xc], ecx
xor dword [eax + 0xc], 0x20000000
cmp ecx, 8
jb 0x4582a4
mov byte [edi + 0x944], 1
mov byte [edi + 0x83c], 1
pop edi
pop esi
ret 4
Function at 0x458560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506a0b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x528af4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x14]
call fcn.0047b090
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 0x3c], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 1
call fcn.0048f5a0
push 0x40000
push dword [edi]
lea ecx, [edi + 0x14]
mov dword [edi + 4], eax
push 0x458c10
call fcn.0047b3c0
lea ecx, [edi + 0x14]
call fcn.0047b1e0
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45c770
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
xor eax, eax
push esi
push edi
mov word [ebp + 0xa3f2], ax
mov byte [ebp + 0xa3e9], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
mov byte [esp + 0x13], 1
push 0
push 0
push ebx
call fcn.0048dfd0
mov esi, eax
test esi, esi
je 0x45c805
sub esi, ebx
sar esi, 1
add esi, 2
lea eax, [esi + esi]
push eax
call fcn.004f2e54
mov edi, eax
add esp, 4
test edi, edi
je 0x45c805
push esi
push edi
push ebx
call fcn.0048dfd0
mov ebx, eax
test ebx, ebx
je 0x45c805
cmp byte [esp + 0x13], 0
jne 0x45c7f5
cmp byte [esp + 0x18], 0
mov ecx, ebp
push edi
je 0x45c7f0
call fcn.0045c960
push edi
call fcn.004f252e
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x45c793
call fcn.0045c4b0
push edi
call fcn.004f252e
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x45c793
cmp byte [esp + 0x18], 0
jne 0x45c813
mov ecx, ebp
call fcn.0045c820
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x45e330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x45e363
test bl, 7
je 0x45e363
movzx edx, byte [ebx]
inc ebx
movzx ecx, al
xor edx, ecx
shr eax, 8
mov dword [esp + 0x10], ebx
xor eax, dword [edx*4 + 0x565700]
sub esi, 1
jne 0x45e342
cmp esi, 8
jb 0x45e3f9
push edi
mov edi, esi
shr edi, 3
xor eax, dword [ebx]
sub esi, 8
mov ebx, dword [ebx + 4]
mov edx, ebx
shr edx, 0x18
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
mov edx, dword [edx*4 + 0x565700]
xor edx, dword [ecx*4 + 0x565b00]
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x565f00]
mov ecx, eax
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x566700]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x566b00]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
movzx eax, al
xor edx, dword [ecx*4 + 0x566f00]
movzx ecx, bl
mov ebx, dword [esp + 0x14]
add ebx, 8
mov dword [esp + 0x14], ebx
xor edx, dword [ecx*4 + 0x566300]
xor edx, dword [eax*4 + 0x567300]
mov eax, edx
sub edi, 1
jne 0x45e372
pop edi
test esi, esi
je 0x45e41a
lea ecx, [ecx]
movzx edx, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x565700]
sub esi, 1
jne 0x45e400
pop esi
pop ebx
ret 0xc
Function at 0x45e420
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], ebx
test ebp, ebp
je 0x45e477
mov eax, dword [esp + 0x20]
lea ecx, [ecx]
test al, 7
je 0x45e477
movzx ecx, byte [eax]
dec ebp
movzx eax, bl
xor ecx, eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x20]
shrd ebx, edx, 8
inc eax
xor ebx, dword [ecx*8 + 0x567700]
shr edx, 8
xor edx, dword [ecx*8 + 0x567704]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], eax
test ebp, ebp
jne 0x45e440
mov eax, ebp
mov dword [esp + 8], 0
shr eax, 3
push esi
mov esi, dword [esp + 0x24]
lea eax, [esi + eax*8]
mov ecx, eax
sub ecx, esi
add ecx, 7
shr ecx, 3
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov dword [esp + 0x10], eax
mov eax, esi
jbe 0x45e59f
mov ebp, dword [esp + 0x10]
push edi
nop
mov esi, dword [eax + 4]
mov ebx, dword [eax]
xor esi, edx
xor ebx, dword [esp + 0x20]
mov edx, esi
shr edx, 0x18
mov eax, esi
shr eax, 0x10
mov ecx, ebx
movzx eax, al
mov dword [esp + 0x18], esi
mov edi, dword [edx*8 + 0x567700]
mov edx, dword [edx*8 + 0x567704]
xor edx, dword [eax*8 + 0x567f04]
xor edi, dword [eax*8 + 0x567f00]
mov eax, esi
shr eax, 8
movzx eax, al
xor edx, dword [eax*8 + 0x568704]
xor edi, dword [eax*8 + 0x568700]
movzx eax, byte [esp + 0x18]
xor edx, dword [eax*8 + 0x568f04]
xor edi, dword [eax*8 + 0x568f00]
mov eax, esi
shrd ecx, eax, 0x18
shr eax, 0x18
movzx eax, cl
mov ecx, ebx
xor edx, dword [eax*8 + 0x569704]
xor edi, dword [eax*8 + 0x569700]
mov eax, esi
shrd ecx, eax, 0x10
shr eax, 0x10
movzx eax, cl
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
xor edx, dword [eax*8 + 0x569f04]
xor edi, dword [eax*8 + 0x569f00]
mov eax, ebx
shrd eax, esi, 8
movzx eax, al
shr esi, 8
xor edi, dword [eax*8 + 0x56a700]
xor edx, dword [eax*8 + 0x56a704]
movzx eax, bl
mov ebx, edi
mov dword [esp + 0x20], edi
xor ebx, dword [eax*8 + 0x56af00]
xor edx, dword [eax*8 + 0x56af04]
mov eax, dword [esp + 0x28]
add eax, 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
cmp ecx, ebp
jb 0x45e4b0
mov ebp, dword [esp + 0x2c]
pop edi
pop esi
and ebp, 7
jbe 0x45e5d0
movzx ecx, byte [eax]
movzx eax, bl
xor ecx, eax
mov eax, dword [esp + 0x20]
shrd ebx, edx, 8
inc eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x567700]
xor edx, dword [ecx*8 + 0x567704]
mov dword [esp + 0x20], eax
sub ebp, 1
jne 0x45e5a5
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 0x10
Function at 0x45ebf0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x168
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x164], eax
push esi
mov esi, dword [esp + 0x174]
push edi
mov edi, dword [esp + 0x174]
cmp dword [edi], 2
jne 0x45ecb2
mov eax, dword [edi + 4]
push ebx
push ebp
mov dword [esp + 0x10], eax
lea eax, [esp + 0x134]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x20
push esi
call fcn.00460030
xor ebx, ebx
mov dword [edi + 4], 0
xor edx, edx
lea ebp, [ebx - 2]
jmp 0x45ec50
movzx eax, byte [esp + ebx + 0x134]
mov ecx, ebx
and ecx, 3
shl ecx, 3
shl eax, cl
lea ecx, [ebp - 1]
xor edx, eax
and ecx, 3
movzx eax, byte [esp + ebx + 0x135]
shl ecx, 3
shl eax, cl
mov ecx, ebp
xor edx, eax
and ecx, 3
movzx eax, byte [esp + ebx + 0x136]
shl ecx, 3
shl eax, cl
lea ecx, [ebp + 1]
xor edx, eax
and ecx, 3
movzx eax, byte [esp + ebx + 0x137]
add ebp, 4
shl ecx, 3
add ebx, 4
shl eax, cl
xor edx, eax
cmp ebx, 0x20
jb 0x45ec50
pop ebp
mov dword [edi + 4], edx
pop ebx
cmp dword [edi], 3
jne 0x45ee3f
lea eax, [esp + 0xec]
xor edx, edx
sub esi, eax
lea ecx, [esp + 0xec]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, 0x20
jb 0x45ecc6
lea eax, [esp + 0xc]
mov dword [esp + 0x10c], 0x36363636
push eax
mov dword [esp + 0x114], 0x36363636
mov dword [esp + 0x118], 0x36363636
mov dword [esp + 0x11c], 0x36363636
mov dword [esp + 0x120], 0x36363636
mov dword [esp + 0x124], 0x36363636
mov dword [esp + 0x128], 0x36363636
mov dword [esp + 0x12c], 0x36363636
call fcn.0048d780
push 0x40
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0048d7d0
push 0x20
add edi, 4
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0048d7d0
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0048d630
lea eax, [esp + 0x7c]
push eax
call fcn.0048d780
xor edx, edx
lea ecx, [esp + 0xec]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor al, 0x5c
mov byte [ecx], al
cmp edx, 0x20
jb 0x45ed80
push 0x40
lea eax, [esp + 0xf0]
mov dword [esp + 0x110], 0x5c5c5c5c
push eax
lea eax, [esp + 0x84]
mov dword [esp + 0x118], 0x5c5c5c5c
push eax
mov dword [esp + 0x120], 0x5c5c5c5c
mov dword [esp + 0x124], 0x5c5c5c5c
mov dword [esp + 0x128], 0x5c5c5c5c
mov dword [esp + 0x12c], 0x5c5c5c5c
mov dword [esp + 0x130], 0x5c5c5c5c
mov dword [esp + 0x134], 0x5c5c5c5c
call fcn.0048d7d0
push 0x20
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0048d7d0
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x80]
push eax
call fcn.0048d630
mov ecx, 8
lea esi, [esp + 0x14c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x168
ret 8
Function at 0x45ee60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, ecx
test esi, esi
je 0x45ef0d
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x1234
mov ebx, 1
add word [eax + 0x10b8], bp
lea edi, [edi + 1]
movzx edx, word [eax + 0x10b8]
mov ecx, edx
shr ecx, 1
movzx ecx, cl
movzx ecx, word [eax + ecx*4 + 0xba4]
xor word [eax + 0x10ba], cx
mov ecx, edx
shr ecx, 1
movzx ecx, cl
movzx ecx, word [eax + ecx*4 + 0xba6]
sub word [eax + 0x10bc], cx
movzx ecx, word [eax + 0x10bc]
xor ecx, edx
movzx edx, word [eax + 0x10be]
mov word [eax + 0x10b8], cx
mov cx, bx
ror dx, cl
xor dx, word [eax + 0x10ba]
ror dx, cl
movzx ecx, dx
xor word [eax + 0x10b8], cx
mov word [eax + 0x10be], cx
movzx ecx, word [eax + 0x10b8]
shr ecx, 8
xor byte [edi - 1], cl
sub esi, ebx
jne 0x45ee80
pop edi
pop ebp
pop ebx
pop esi
ret 8
Function at 0x45ef60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [ecx + 0x10ac]
push esi
push edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x24], edi
mov eax, dword [edi]
xor eax, dword [ecx + 0x10a4]
xor ebp, dword [edi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x10a8]
xor eax, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
xor eax, dword [ecx + 0x10b0]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0xc]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, 0x1f
mov dword [esp + 0x18], eax
and eax, 3
mov edx, edi
rol edx, 0xb
add edx, ebp
mov esi, dword [ecx + eax*4 + 0x10a4]
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ebx, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + ecx + 0xfa4]
or ebx, eax
movzx eax, dl
mov edx, ebp
shl ebx, 8
ror edx, 0xf
xor edx, edi
movzx eax, byte [eax + ecx + 0xfa4]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ebx, dword [esp + 0x14]
movzx esi, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
movzx eax, dl
shl esi, 8
mov edx, ebp
mov dword [esp + 0x14], edx
mov ebp, ebx
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
mov eax, dword [esp + 0x18]
xor esi, dword [esp + 0x10]
sub eax, 1
mov dword [esp + 0x10], edi
mov edi, esi
mov dword [esp + 0x18], eax
jns 0x45efd1
mov ebp, dword [ecx + 0x10a4]
mov edi, dword [esp + 0x24]
xor ebp, ebx
mov dword [edi], ebp
mov eax, dword [ecx + 0x10a8]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x10ac]
xor eax, edx
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x10b0]
xor eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esp + 0x28]
push eax
call fcn.0045ff70
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2c
ret 4
Function at 0x45f1a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [ecx + 0x10a8]
push ebx
push ebp
mov ebp, dword [ecx + 0x10ac]
push esi
push edi
mov edi, dword [esp + 0x24]
xor eax, dword [edi + 4]
mov edx, dword [edi]
xor ebp, dword [edi + 8]
xor edx, dword [ecx + 0x10a4]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
mov edi, eax
xor edi, dword [ecx + 0x10b0]
xor eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov edi, edi
and eax, 3
mov edx, edi
rol edx, 0xb
add edx, ebp
mov esi, dword [ecx + eax*4 + 0x10a4]
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ebx, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + ecx + 0xfa4]
or ebx, eax
movzx eax, dl
mov edx, ebp
shl ebx, 8
ror edx, 0xf
xor edx, edi
movzx eax, byte [eax + ecx + 0xfa4]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ebx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
movzx esi, byte [eax + ecx + 0xfa4]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0xfa4]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
movzx eax, dl
shl esi, 8
mov edx, ebp
mov ebp, ebx
movzx eax, byte [eax + ecx + 0xfa4]
or esi, eax
mov eax, dword [esp + 0x18]
xor esi, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], edi
mov edi, esi
mov dword [esp + 0x18], eax
cmp eax, 0x20
jl 0x45f1e0
mov eax, dword [ecx + 0x10a4]
mov edi, dword [esp + 0x24]
xor eax, ebx
push edi
mov dword [edi], eax
mov eax, dword [ecx + 0x10a8]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x10ac]
xor eax, edx
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x10b0]
xor eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
call fcn.0045ff70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x45f330
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x45f382
push esi
push edi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x10]
cmp eax, 1
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x45f3fd
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0048fd80
lea ecx, [esp + 0x14]
call fcn.0048fbd0
mov ebp, eax
mov ebx, edx
call fcn.004f24cc
cdq
add ebp, eax
adc ebx, edx
xor ecx, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ecx
test edi, edi
je 0x45f3fc
mov ebx, dword [0x56b700]
sub esi, ebx
lea esp, [esp]
mov edx, dword [esp + 0x20]
and ecx, 7
shl ecx, 3
mov eax, ebp
call fcn.004ebf00
mov ecx, dword [esp + 0x24]
xor al, cl
add al, bl
inc ecx
mov byte [esi + ebx], al
inc ebx
mov dword [esp + 0x24], ecx
cmp ecx, edi
jb 0x45f3d0
mov dword [0x56b700], ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x45f5a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov word [ecx + 0x10b5], 0
mov byte [ecx + 0x10b4], 0
mov dl, byte [esi]
test dl, dl
je 0x45f5e6
push ebx
xor al, al
xor bl, bl
xor ah, ah
add al, dl
lea esi, [esi + 1]
add ah, dl
rol al, 1
xor bl, dl
mov byte [ecx + 0x10b4], ah
mov byte [ecx + 0x10b5], bl
mov byte [ecx + 0x10b6], al
mov dl, byte [esi]
test dl, dl
jne 0x45f5c2
pop ebx
pop esi
ret 4

Function at 0x45f5f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xba4]
push eax
call fcn.0045e620
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45f610
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.0045e330
mov word [esi + 0x10b8], ax
shr eax, 0x10
mov word [esi + 0x10ba], ax
xor eax, eax
mov dword [esi + 0x10bc], eax
mov dl, byte [edi]
test dl, dl
je 0x45f683
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
movzx eax, dl
lea edi, [edi + 1]
movzx edx, dl
lea ecx, [esi + eax*4]
movzx eax, word [ecx + 0xba4]
xor ax, dx
xor bp, ax
mov word [esi + 0x10bc], bp
movzx eax, word [ecx + 0xba6]
add ax, dx
add bx, ax
mov word [esi + 0x10be], bx
mov dl, byte [edi]
test dl, dl
jne 0x45f647
pop ebp
pop ebx
pop edi
pop esi
ret 4