joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457c30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7347
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x679cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x64dd48
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.0040e3f0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.0040e4c0
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x457cc3
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.0040e5f0
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00410190
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x7ab388]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4589e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5e58
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x679cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x458b01
cmp byte [edi + 0x49], bl
je 0x458b01
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x458af5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x458a55
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x458a6d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x458a96
dec eax
je 0x458a9a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x458af0
jmp 0x458afc
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x458aaa
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x458ad3
cmp ebx, 0x10
jae 0x458ab9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004b3911
add esp, 0x10
cmp esi, eax
jne 0x458aed
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x458af9
test esi, esi
jne 0x458a61
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00414b80
jmp 0x458a5b
lea ecx, [ebp - 0x2c]
call fcn.00429f70
xor al, al
jmp 0x458b03
lea ecx, [ebp - 0x2c]
call fcn.00429f70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a89
mov esp, ebp
pop ebp
ret
Function at 0x45cae0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x679cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov bl, byte [ecx + 8]
push esi
mov esi, edx
mov dword [ebp - 0x18], eax
cmp bl, 3
je 0x45cca0
mov edx, dword [ecx]
push edi
mov dword [ebp - 0x1c], 0
test bl, 2
je 0x45cb41
movzx eax, byte [ecx + 9]
movzx edi, byte [esi]
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 1]
mov dword [ebp - 0x14], ebx
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 2]
sub eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov edi, 3
jmp 0x45cb53
movzx edi, byte [esi + 3]
movzx ebx, byte [ecx + 9]
sub ebx, edi
mov dword [ebp - 0x14], ebx
mov edi, 1
test byte [ecx + 8], 4
je 0x45cb68
movzx esi, byte [esi + 4]
movzx ebx, byte [ecx + 9]
sub ebx, esi
mov dword [ebp + edi*4 - 0x14], ebx
inc edi
xor esi, esi
test edi, edi
jle case.0x45cbb1.3
cmp dword [ebp + esi*4 - 0x14], 0
jg 0x45cb83
mov dword [ebp + esi*4 - 0x14], 0
jmp 0x45cb8a
mov dword [ebp - 0x1c], 1
inc esi
cmp esi, edi
jl 0x45cb72
cmp word [ebp - 0x1c], 0
je case.0x45cbb1.3
movzx esi, byte [ecx + 9]
add esi, 0xfffffffe
cmp esi, 0xe
ja case.0x45cbb1.3
movzx esi, byte [esi + 0x45ccc4]
jmp dword [esi*4 + 0x45ccb0]
mov ecx, dword [ecx + 4]
test ecx, ecx
je case.0x45cbb1.3
mov dl, byte [eax]
shr dl, 1
and dl, 0x55
mov byte [eax], dl
inc eax
dec ecx
jne 0x45cbc3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a89
mov esp, ebp
pop ebp
ret
mov edi, dword [ecx + 4]
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov edx, 0xf0
sar edx, cl
mov ebx, 0xf
sar ebx, cl
and dl, 0xf0
or dl, bl
test edi, edi
je case.0x45cbb1.3
mov bl, byte [esi]
mov cl, al
shr bl, cl
inc esi
and bl, dl
dec edi
mov byte [esi - 1], bl
jne 0x45cc06
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a89
mov esp, ebp
pop ebp
ret
imul edx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x18], edx
test edx, edx
je case.0x45cbb1.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
cmp ebx, dword [ebp - 0x18]
jb 0x45cc34
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a89
mov esp, ebp
pop ebp
ret
imul edx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x18], edx
test edx, edx
je case.0x45cbb1.3
xor edx, edx
mov eax, ebx
div edi
movzx eax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc ebx
add esi, 2
movzx ecx, word [ebp + edx*4 - 0x14]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, dword [ebp - 0x18]
jb 0x45cc67
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00490a89
mov esp, ebp
pop ebp
ret
Function at 0x466a70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x466ac1
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0x1c
push 1
push esi
call ecx
mov dword [esi + 0x190], eax
mov dword [eax], 0x4686c0
mov dword [eax + 4], 0x468820
mov byte [eax + 8], 0
add esp, 0xc
mov eax, esi
call fcn.00468500
cmp byte [esi + 0x40], 0
je 0x466aba
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x466b3b
mov edx, dword [esi + 0x1a0]
cmp byte [edx + 0x10], 0
je 0x466b2b
mov eax, dword [esi + 8]
test eax, eax
je 0x466ae6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov ecx, dword [esi + 0x1a0]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
test eax, eax
je 0x466b27
cmp eax, 2
je 0x466b2b
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x466ad7
cmp eax, 3
je 0x466b0e
cmp eax, 1
jne 0x466ad7
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x466ad7
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x466ad7
xor al, al
pop esi
ret
mov edx, dword [esi + 0x7c]
mov dword [esi + 0x84], edx
call fcn.00466b70
pop esi
ret
cmp eax, 0xcc
je 0x466b5d
mov eax, dword [esi]
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
call fcn.00466b70
pop esi
ret
Function at 0x469cc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x4c], 1
push esi
mov esi, dword [ebx + 0x1b8]
push edi
mov dword [ebp - 0x14], esi
jne 0x469ce8
mov dword [ebp - 4], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x469cf3
mov dword [ebp - 4], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push ebx
call eax
xor edi, edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 8], edi
cmp dword [ebx + 0x64], edi
jle 0x469dff
jmp 0x469d2e
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
je 0x469d4e
mov edx, dword [esi + 0x18]
add dword [edx + edi*4], 0xff
lea eax, [edx + edi*4]
mov eax, dword [esi + 0x18]
mov edi, dword [eax + edi*4]
lea eax, [ecx + 0xfe]
lea esi, [ecx + ecx - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov esi, eax
lea ebx, [ebx]
cmp ecx, esi
jle 0x469dac
mov eax, dword [ebp - 0xc]
mov edx, ebx
imul edx, edx, 0x1fe
lea edi, [edx + eax + 0xfe]
jmp 0x469d90
mov esi, dword [ebp - 0xc]
add edi, 0x1fe
mov eax, edi
cdq
lea esi, [esi + esi - 2]
idiv esi
inc ebx
mov esi, eax
cmp ecx, esi
jg 0x469d90
mov edi, dword [ebp - 0x18]
mov al, byte [ebp - 0x10]
imul bl
mov byte [ecx + edi], al
inc ecx
cmp ecx, 0xff
jle 0x469d70
cmp dword [ebp - 4], 0
je 0x469dec
mov eax, 1
lea ecx, [edi - 1]
jmp 0x469dd0
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x469dd0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ecx + 0x64]
jl 0x469d25
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x475b89
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00491960
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x475b60
sub eax, ebx
jmp 0x475b62
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x475b51
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x475b7f
sub eax, ebx
jmp 0x475b81
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x475b70
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x475c5b
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.004758b0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x475bd3
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x475be7
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x475b15
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x475c5b
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x475c2a
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x475c0e
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.00493600
add esp, 0xc
add ebx, esi
pop esi
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x475c5b
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x475c44
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.00493600
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebx
ret
Function at 0x47c240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
xor edx, edx
cmp edi, edx
je 0x47c2c8
mov ecx, dword [edi]
push ebx
push esi
mov esi, dword [edi + 4]
xor eax, eax
mov word [ecx + 0x16], dx
mov word [ecx + 0x18], dx
cmp esi, edx
jle 0x47c281
movzx edi, byte [ecx + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x6257e8]
inc edx
cmp edx, esi
jl 0x47c262
mov edi, dword [ebp + 8]
xor edx, edx
mov esi, dword [edi + 0xc]
cmp esi, edx
jle 0x47c2ad
mov edi, dword [edi + 8]
mov dword [ebp + 8], edi
mov edi, edi
mov edi, dword [ebp + 8]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x6257e8]
inc edx
cmp edx, esi
jl 0x47c290
mov edx, eax
shr edx, 8
mov byte [ecx + 0x16], al
mov byte [ecx + 0x17], dl
mov edx, eax
shr edx, 0x10
shr eax, 0x18
pop esi
mov byte [ecx + 0x18], dl
mov byte [ecx + 0x19], al
pop ebx
pop edi
pop ebp
ret
Function at 0x4dae90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
test eax, eax
je 0x4daed2
cmp byte [esi + 0xe], 0
jne 0x4daed2
cmp byte [esi + 0xc], 0
mov byte [esi + 0xe], 1
je 0x4daeb1
push eax
call dword [0x6100d8]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [0x6100bc]
mov eax, dword [esi + 4]
test eax, eax
je 0x4daed2
push eax
call dword [0x6100e8]
mov dword [esi + 4], 0
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x4dad50
push 0
push 0
mov dword [eax], 0
mov dword [esi + 4], 0
mov byte [esi + 0xe], 0
mov byte [esi + 0xc], 1
call fcn.004b3252
mov ecx, dword [ebp + 8]
add esp, 0x18
push ecx
push eax
mov dword [esi + 4], eax
call dword [0x6100dc]
mov al, 1
pop ebp
ret 4

Function at 0x4db7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x24]
test edi, edi
jg 0x4db809
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x198]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop edi
mov esp, ebp
pop ebp
ret 0x20
cmp edi, 0x100
jl 0x4db843
mov eax, dword [ebp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x19c]
push 0xffffff
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call edx
pop edi
mov esp, ebp
pop ebp
ret 0x20
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
jle 0x4db8e6
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
lea eax, [edx*4]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x18], ecx
push ebx
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + esi*4]
add ecx, dword [ebp + 0x18]
xor edx, edx
test eax, eax
jle 0x4db8d6
nop
mov esi, dword [ecx]
mov eax, esi
not eax
mov ebx, eax
and ebx, 0xffff00ff
imul ebx, edi
mov edi, eax
and edi, 0xff00
imul edi, dword [ebp + 0x24]
xor ebx, edi
mov edi, dword [ebp + 0x24]
and eax, 0xff00ff
imul eax, edi
and ebx, 0xff0000
xor ebx, eax
mov eax, dword [ebp + 8]
shr ebx, 8
add ebx, esi
mov dword [eax], ebx
add eax, 4
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + edx*4]
lea ecx, [ecx + eax*4]
mov eax, dword [ebp + 0xc]
inc edx
cmp edx, eax
jl 0x4db880
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
add dword [ebp + 8], ecx
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp + 0x10]
jl 0x4db870
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4db8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x24]
test esi, esi
jg 0x4db928
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x19c]
push 0
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop esi
pop ebp
ret 0x20
cmp esi, 0x100
jl 0x4db95b
mov eax, dword [ebp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x198]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call edx
pop esi
pop ebp
ret 0x20
xor eax, eax
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x10], eax
jle 0x4dba07
mov ecx, dword [ebp + 0x18]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x14]
push ebx
mov dword [ebp + 0x18], edx
lea edx, [ecx*4]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x14], edx
jmp 0x4db990
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp + 0x18]
xor edx, edx
test edi, edi
jle 0x4db9f6
nop
mov eax, dword [ecx]
mov edi, eax
and edi, 0xffff00ff
mov ebx, eax
imul edi, esi
and ebx, 0xff00
imul ebx, esi
xor edi, ebx
mov ebx, eax
and ebx, 0xff00ff
imul ebx, esi
and edi, 0xff0000
xor edi, ebx
and eax, 0xff000000
shr edi, 8
or edi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + edx*4]
inc edx
lea ecx, [ecx + eax*4]
cmp edx, edi
jl 0x4db9a0
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x14]
add dword [ebp + 8], ecx
inc eax
mov dword [ebp + 0x24], eax
cmp eax, dword [ebp + 0x10]
jl 0x4db990
pop edi
pop ebx
pop esi
pop ebp
ret 0x20
Function at 0x4dbab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0x24]
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 1], al
mov edx, ecx
xor eax, eax
sar edx, 8
mov byte [ebp - 2], dl
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
jle 0x4dbbea
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp + 0x18], edx
mov edx, dword [ebp + 0x14]
push ebx
add edx, edx
add edx, edx
push esi
mov dword [ebp - 0x14], edx
push edi
mov edi, edi
mov edx, dword [ebp + 0x20]
mov esi, dword [edx + eax*4]
add esi, dword [ebp + 0x18]
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x4dbbd4
movzx edx, byte [ebp - 2]
movzx eax, cl
movzx ecx, byte [ebp - 1]
mov dword [ebp + 0x14], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
jmp 0x4dbb20
mov ebx, dword [esi]
movzx ecx, bl
imul ecx, dword [ebp + 0x14]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp - 0xc]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 0x10]
mov eax, 0x80808081
mul edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
not eax
shr edx, 7
and edx, 0xff00
or ecx, edx
mov edx, eax
xor eax, ecx
and eax, 0xfefefe
and edx, ecx
lea eax, [eax + edx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov edx, eax
or edx, ecx
mov ecx, dword [ebp + 8]
or eax, dword [ecx]
add ecx, 4
sub eax, edx
mov edx, dword [ebp + 0x1c]
xor eax, ebx
and eax, 0xffffff
xor eax, ebx
mov dword [ecx - 4], eax
mov eax, dword [edx + edi*4]
inc edi
mov dword [ebp + 8], ecx
lea esi, [esi + eax*4]
cmp edi, dword [ebp + 0xc]
jl 0x4dbb20
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
add dword [ebp + 8], edx
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jl 0x4dbaf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4dbbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x24]
sub esp, 0x18
test ecx, ecx
je 0x4dbd33
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 1], al
mov edx, ecx
xor eax, eax
sar edx, 8
mov byte [ebp - 2], dl
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
jle 0x4dbd33
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x14]
push ebx
add edx, edx
add edx, edx
push esi
mov dword [ebp - 0x18], edx
push edi
mov edx, dword [ebp + 0x20]
mov edi, dword [edx + eax*4]
add edi, dword [ebp - 0xc]
cmp dword [ebp + 0xc], 0
mov dword [ebp + 0x18], 0
jle 0x4dbd1d
movzx edx, byte [ebp - 2]
movzx eax, cl
movzx ecx, byte [ebp - 1]
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov ebx, dword [edi]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
movzx ecx, bl
imul ecx, dword [ebp + 0x14]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp - 0x10]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 0x14]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov edx, ecx
mov eax, ecx
and eax, esi
xor edx, esi
and edx, 0xfefefe
lea eax, [edx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
sub ecx, eax
add ecx, esi
or ecx, eax
mov eax, dword [ebp + 8]
xor ecx, ebx
and ecx, 0xffffff
xor ecx, ebx
mov dword [eax], ecx
mov ecx, dword [ebp + 0x1c]
add eax, 4
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ecx + eax*4]
inc eax
lea edi, [edi + edx*4]
mov dword [ebp + 0x18], eax
cmp eax, dword [ebp + 0xc]
jl 0x4dbc64
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
add dword [ebp + 8], edx
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jl 0x4dbc36
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4dbe40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x24]
test eax, eax
jle 0x4dbf45
cmp eax, 0x100
jle 0x4dbe5e
mov eax, 0x100
mov dword [ebp + 0x24], eax
xor edx, edx
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], edx
jle 0x4dbf45
mov ecx, dword [ebp + 0x18]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 0x14]
add ecx, ecx
push ebx
add ecx, ecx
push esi
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
push edi
mov esi, dword [ebp + 0x20]
mov esi, dword [esi + edx*4]
add esi, dword [ebp + 0x18]
xor edi, edi
test ecx, ecx
jle 0x4dbf2f
lea esp, [esp]
mov edx, dword [esi]
mov ecx, edx
and ecx, 0xffff00ff
imul ecx, eax
mov ebx, edx
and ebx, 0xff00
imul ebx, eax
xor ecx, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
not eax
and ecx, 0xff0000
xor ecx, ebx
mov ebx, eax
shr ecx, 8
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, ecx
mov ecx, dword [ebp + 8]
or eax, dword [ecx]
add ecx, 4
sub eax, ebx
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov edx, dword [ebp + 0x1c]
mov dword [ecx - 4], eax
mov eax, dword [edx + edi*4]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0xc]
inc edi
lea esi, [esi + eax*4]
mov eax, dword [ebp + 0x24]
cmp edi, ecx
jl 0x4dbea0
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 0x14]
add dword [ebp + 8], esi
inc edx
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 0x10]
jl 0x4dbe86
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20