joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
mov esi, dword [eax]
lea eax, [edi + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x4aca47
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x4ac9ad
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004ad3d0
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
add dword [esp + 0xc], ebp
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov bl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor bl, byte [eax]
mov ebp, dword [esp + 0x18]
inc esi
mov byte [ebp], bl
inc ebp
inc eax
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], eax
jne 0x4ac944
cmp dword [esp + 0xc], 0
je 0x4aca2f
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
Function at 0x4b03b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, edx
xor ebp, ebp
test edi, edi
jle 0x4b0485
cmp edi, 3
movzx edx, byte [esi]
jl 0x4b0421
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x4b0473
shl edx, 0x10
cmp edi, 2
jne 0x4b0432
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x4b0460
lea edx, [edi + 0x3c]
jmp 0x4b046d
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x4b03c3
pop edi
pop esi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x4bd790
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, edx
cmp dword [esp + 0xc], esi
jne 0x4bd858
mov al, byte [ecx]
cmp al, 0x6a
je 0x4bd7ab
cmp al, 0x6b
jne 0x4bd858
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4bd819
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4bd7d0
jmp 0x4bd7c0
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4bd7d0
cmp al, 0xbb
jne 0x4bd7f9
inc ecx
cmp ecx, esi
jl 0x4bd7c0
sub esi, ecx
test ecx, ecx
jne 0x4bd81c
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 4
mov ecx, 0x80
call fcn.00460970
add esp, 0x10
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 4
mov ecx, 0x80
call fcn.00460970
add esp, 0x10
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4bd845
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 4
mov ecx, 0x80
call fcn.00460970
add esp, 0x10
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.005165f0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 4
mov ecx, 0x80
call fcn.00460970
add esp, 0x10
or eax, 0xffffffff
pop esi
ret
Function at 0x4c57e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edi + 0x10c], 0xffffffff
push ebx
mov ebx, dword [esp + 8]
jne 0x4c57f2
xor eax, eax
pop ebx
ret
mov eax, dword [edi]
push esi
mov esi, dword [eax + 4]
mov dword [ecx], esi
test ebx, ebx
je 0x4c5893
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x4c5830
test esi, esi
jle 0x4c5871
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
jmp 0x4c5820
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x4c5820
jmp 0x4c5871
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x4c5855
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.00516180
add esp, 0xc
test esi, esi
jle 0x4c5871
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x4c5863
mov eax, dword [edi]
mov ecx, dword [eax + 0x18]
push esi
push ebx
push ebx
push edi
call ecx
add esp, 0x10
pop ebp
test eax, eax
jne 0x4c5893
push esi
push ebx
call fcn.004daa60
add esp, 8
pop esi
xor eax, eax
pop ebx
ret
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4c7540
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
cmp ecx, dword [eax + 4]
push esi
push edi
jge 0x4c755c
mov edi, eax
jmp 0x4c7560
mov edi, ebp
mov ebp, eax
mov esi, dword [edi + 4]
cmp esi, dword [ebx + 8]
mov dword [esp + 0x1c], esi
jle 0x4c7598
push esi
push ebx
call fcn.004652b0
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x4c75fd
mov ecx, dword [ebx]
test ecx, ecx
je 0x4c7593
mov esi, ecx
call fcn.004748e0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov dword [ebx + 8], esi
xor eax, eax
cmp dword [ebp + 4], eax
jle 0x4c75b6
nop
mov edx, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebp + 4]
jl 0x4c75a0
cmp eax, dword [edi + 4]
jge 0x4c75d0
jmp 0x4c75c0
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4c75c0
mov edi, dword [edi + 4]
mov eax, edi
mov dword [ebx + 4], edi
test eax, eax
jle 0x4c75f3
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4c75f0
dec eax
test eax, eax
jg 0x4c75e2
mov dword [ebx + 4], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4cc3c0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.00525ec0
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
push 0x1048
push 0x55ae68
push ebx
mov edi, ecx
mov esi, edx
call fcn.005165f0
add esp, 0xc
cmp esi, 0x48
jle 0x4cc3f2
mov esi, 0x48
lea ecx, [esi + edi]
mov eax, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4cc40d
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc41c
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc42b
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc43a
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4cc447
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc456
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc465
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc474
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4cc481
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc490
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc49f
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4cc4ae
mov eax, edi
xor dword [esi], edx
add esi, 0xc
sub dword [esp + 0x1c], 1
jne 0x4cc403
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
jmp 0x4cc4d0
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004f3c80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4cc4d0
xor esi, esi
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004f3c80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x4cc4f7
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4cc730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
mov esi, dword [eax]
lea eax, [edi + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x4cc907
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x4cc86d
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004f3c80
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
add dword [esp + 0xc], ebp
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov bl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor bl, byte [eax]
mov ebp, dword [esp + 0x18]
inc esi
mov byte [ebp], bl
inc ebp
inc eax
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], eax
jne 0x4cc804
cmp dword [esp + 0xc], 0
je 0x4cc8ef
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
Function at 0x4ccbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
mov esi, dword [eax]
lea eax, [edi + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x4ccdc7
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x4ccd2d
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004f4700
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
add dword [esp + 0xc], ebp
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov bl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor bl, byte [eax]
mov ebp, dword [esp + 0x18]
inc esi
mov byte [ebp], bl
inc ebp
inc eax
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], eax
jne 0x4cccc4
cmp dword [esp + 0xc], 0
je 0x4ccdaf
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511c1b
add esp, 0x2c
ret
Function at 0x4dc400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4dc4db
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4dc476
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004dc040
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4dc444
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4dc594
call 0x4dc488
pop edx
lea ecx, [edx + 0x138]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4dc533
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004dc040
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4dc4ec
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4dc594
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004dc040
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4dc58f
jmp 0x4dc594
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4dc600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4dc6e4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4dc67f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004dc1a0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4dc64d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4dc79d
call 0x4dc691
pop edx
lea ecx, [edx + 0x12f]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4dc73c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004dc2d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4dc6f5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4dc79d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004dc2d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4dc798
jmp 0x4dc79d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e00c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4e00de
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret
Function at 0x4e0120
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4e013e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x4e0180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4e01a2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x4e0200
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4e0222
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x4e0280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4e02aa
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret