joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443f40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x44409a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00443df0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x44406d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x443ff3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x444063
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x44402d
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x444025
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x444060
cmp edi, edx
je 0x44403d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x444076
cmp edi, edx
jne 0x444031
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x443fa2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x444060
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x4442a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x4443da
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
push eax
call fcn.00443df0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4443ad
mov bl, byte [eax + 8]
mov edi, dword [ebp - 8]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 4], edx
cmp edi, esi
jne 0x444339
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4443a3
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x444370
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x444368
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x4443a3
cmp edi, edx
je 0x444380
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x4443b6
cmp edi, edx
jne 0x444374
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x444305
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4443a3
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x444af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x444c8a
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x444b2b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x444b54
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x444b40
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00443870
push 0x48
push edi
call fcn.0054f9fc
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x444bb9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x444b70
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x444ba8
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x444bcb
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x444bce
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x444c7d
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jb 0x444bee
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x444c14
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x444c00
mov eax, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00443870
push 0x48
push edi
call fcn.0054f9fc
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x444c67
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x444c26
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x444be0
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x447bd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
imul ecx, edx, 0x1000193
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x2b0]
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00441ef0
mov esi, dword [eax + 4]
test esi, esi
jne 0x447c38
mov esi, dword [edi + 0x2b4]
mov edx, dword [edi + 0x2b4]
cmp esi, edx
je 0x447ce9
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x2c8]
and ecx, eax
mov eax, dword [edi + 0x2bc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x447ca4
cmp eax, esi
jne 0x447c9c
mov dword [ecx], edx
mov dword [ecx + 4], edx
jmp 0x447cac
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
jmp 0x447cac
cmp eax, esi
jne 0x447cac
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 0x2b8]
lea edi, [esi + 0x10]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x447cde
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x38
push esi
call fcn.0054f9fc
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x449780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556cdd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x62aabc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x44984d
nop dword [eax]
sub edx, ecx
add ecx, dword [ebp + 8]
push 0
push edx
push ecx
push dword [ebx + 0x28]
mov dword [ebp - 0x14], edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x44983a
nop dword [eax + eax]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x44980d
cmp eax, 0x2714
je 0x44983a
sub eax, 4
je 0x44983a
sub eax, 7
je 0x44980d
sub eax, 0x7f
je 0x44980d
mov eax, edi
inc edi
cmp eax, 4
jg 0x449866
jmp 0x44981f
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x449861
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x449881
mov eax, dword [ebp - 0x10]
add eax, dword [ebp + 8]
push 0
push dword [ebp - 0x14]
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x4497e0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
mov dword [ebp - 0x10], ecx
cmp ecx, edx
jb 0x4497c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_read
lea ecx, [ebp - 0x20]
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [0x62da44]
push str.Connection_lost__will_need_to_reconnect...
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
mov eax, dword [eax]
push str.cspot
mov esi, dword [eax + 4]
call fcn.00409c70
push 0x92
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push str.D:UsersphiliDropboxDevelopmentSpotConnectcommoncspotcspot_srcPlainConnection.cpp
call fcn.00409c70
push dword [0x62da44]
mov dword [ebp - 4], 0xffffffff
call esi
add esp, 0x3c
lea ecx, [ebp - 0x2c]
push str.Reconnection_required
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x2c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x449a00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556d5e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x62aabc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov edx, dword [edi + 4]
sub edx, dword [edi]
mov eax, dword [ebx + 4]
add edx, 4
sub eax, dword [ebx]
add eax, edx
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, eax
mov eax, dword [ebp + 8]
push 4
mov ecx, eax
mov dword [ebp + 0xc], esi
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0040def0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax], esi
add eax, 4
mov dword [edx + 4], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
mov dword [ebp - 4], 0
push eax
push ecx
push dword [edx]
mov ecx, edx
mov dword [ebp - 0x14], 3
call fcn.004421e0
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov ebx, dword [ebp + 8]
sub eax, ecx
push eax
push ecx
mov ecx, ebx
push dword [ebx + 4]
call fcn.004421e0
mov eax, dword [ebx + 4]
xor edi, edi
xor esi, esi
sub eax, dword [ebx]
je 0x449b58
nop dword [eax]
mov eax, dword [ebx + 4]
mov ecx, 0x40
mov edx, dword [ebx]
sub eax, edi
sub eax, edx
cmp eax, ecx
push 0
cmovb ecx, eax
lea eax, [edx + edi]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x449b49
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x449b2a
cmp eax, 0x2714
je 0x449b46
sub eax, 4
je 0x449b46
sub eax, 7
je 0x449b2a
sub eax, 0x7f
je 0x449b2a
mov eax, esi
inc esi
cmp eax, 4
jg 0x449b73
jmp 0x449ad0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x449b6e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x449ad0
push str.Reconnection_required
jmp 0x449b78
mov eax, dword [ebp + 0xc]
add edi, eax
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp edi, eax
jb 0x449ad0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x20]
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x449b90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
xor esi, esi
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
je 0x449c45
mov eax, dword [ebp + 8]
push 0
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sub eax, ecx
mov ecx, 0x40
cmp eax, ecx
cmovb ecx, eax
mov eax, dword [ebp - 4]
push ecx
add eax, edx
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jg 0x449c29
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x449c12
cmp eax, 0x2714
je 0x449c29
sub eax, 4
je 0x449c29
sub eax, 7
je 0x449c12
sub eax, 0x7f
je 0x449c12
mov eax, esi
inc esi
cmp eax, 4
jg 0x449c5e
mov ecx, dword [ebp - 4]
jmp 0x449bb4
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x449c59
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x449c52
mov ecx, dword [ebp - 4]
jmp 0x449bb4
mov ecx, dword [ebp - 4]
add ecx, edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
cmp ecx, eax
jb 0x449bb4
sub edx, edi
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Reconnection_required
jmp 0x449c63
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x10]
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x457be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x457c40
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x457c40
jne 0x457c38
cmp eax, edx
jge 0x457c38
mov ecx, dword [ebp + 8]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x457c68
inc eax
cmp eax, edx
jl 0x457c27
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x457c06
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x457c80
mov esi, dword [ebp + 0x18]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x457c71
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x457c73
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x457c80
inc eax
xor bl, 1
cmp eax, edi
jb 0x457c50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
mov edx, dword [esi + 0xcc]
lea eax, [esi + 0xc8]
mov dword [ebp - 4], ebx
test edx, edx
je 0x45a775
mov ecx, edx
nop word [eax + eax]
test ebx, ebx
je 0x45a759
mov eax, dword [esi + 0xc4]
mov ecx, 0x20
sub ecx, edx
dec ebx
shr eax, cl
mov ecx, 0x20
xor byte [edi], al
mov edx, dword [esi + 0xcc]
sub ecx, edx
movzx eax, byte [edi]
add edx, 0xfffffff8
shl eax, cl
inc edi
xor dword [esi + 0xc8], eax
mov ecx, edx
mov dword [esi + 0xcc], edx
mov dword [ebp - 4], ebx
test edx, edx
jne 0x45a700
push dword [esi + 0xc8]
lea eax, [esi + 0xc8]
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0045aef0
jmp 0x45a778
lea eax, [esi + 0xc8]
mov dword [ebp + 8], eax
test ecx, ecx
jne 0x45a8ad
push dword [eax]
mov ecx, esi
call fcn.0045aef0
jmp 0x45a778
mov dword [ebp + 8], eax
mov eax, ebx
and eax, 0xfffffffc
add eax, edi
mov dword [ebp - 8], eax
cmp edi, eax
jae 0x45a84e
mov ebx, eax
nop dword [eax]
mov ecx, esi
call fcn.0045a5d0
movzx edx, byte [edi + 3]
movzx eax, byte [edi + 2]
mov ecx, dword [esi + 0x48]
xor ecx, dword [esi + 0x7c]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
mov eax, dword [esi + 0x44]
xor edx, dword [esi + 0xc4]
xor ecx, edx
xor ecx, dword [esi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x58]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x78], eax
mov eax, edx
xor dword [esi + 0x34], edx
shr eax, 0x18
mov dword [esi + 0x7c], ecx
mov byte [edi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi], dl
add edi, 4
cmp edi, ebx
jb 0x45a790
mov ebx, dword [ebp - 4]
and ebx, 3
je 0x45a8ad
mov ecx, esi
call fcn.0045a5d0
mov eax, dword [ebp + 8]
mov edx, 0x20
mov dword [esi + 0xcc], 0x20
mov dword [eax], 0
test ebx, ebx
je 0x45a8ad
mov eax, dword [esi + 0xc4]
mov ecx, 0x20
sub ecx, edx
dec ebx
shr eax, cl
mov ecx, 0x20
xor byte [edi], al
mov edx, dword [esi + 0xcc]
sub ecx, edx
movzx eax, byte [edi]
add edx, 0xfffffff8
shl eax, cl
inc edi
mov ecx, dword [ebp + 8]
mov dword [esi + 0xcc], edx
xor dword [ecx], eax
test edx, edx
jne 0x45a872
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45a8c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x10
nop dword [eax + eax]
mov esi, dword [ecx + 0x34]
xor esi, dword [ecx + 0xc0]
xor esi, dword [ecx + 0x30]
mov edi, dword [ecx]
mov edx, esi
shr edx, 2
or edx, esi
ror edi, 0x1f
shr edx, 0x19
lea eax, [esi*4]
or eax, esi
shl eax, 5
or edx, eax
xor esi, edx
mov eax, esi
shr eax, 3
or eax, esi
shr eax, 0xa
lea edx, [esi*8]
or edx, esi
shl edx, 0x13
or edx, eax
mov eax, dword [ecx + 4]
mov dword [ecx], eax
xor edi, edx
mov eax, dword [ecx + 8]
xor edi, esi
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x20]
mov dword [ecx + 0x1c], eax
mov eax, dword [ecx + 0x24]
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 0x28]
mov dword [ecx + 0x24], eax
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x28], eax
mov eax, dword [ecx + 0x30]
mov dword [ecx + 0x2c], eax
mov eax, dword [ecx + 0x34]
mov dword [ecx + 0x30], eax
mov eax, dword [ecx + 0x38]
mov dword [ecx + 0x34], eax
mov eax, dword [ecx + 0x3c]
mov dword [ecx + 0x38], eax
mov esi, dword [ecx + 8]
xor esi, edi
mov dword [ecx + 0x3c], edi
mov edx, esi
mov eax, esi
shr edx, 0xf
shl eax, 0xf
or edx, esi
or eax, esi
shr edx, 0xa
shl eax, 7
or edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
shr edx, 0xe
shl eax, 0xe
or edx, esi
or eax, esi
shr edx, 0xd
shl eax, 5
or edx, eax
mov eax, dword [ecx + 0x30]
xor edx, esi
xor dword [ecx], edx
xor eax, edx
xor eax, dword [ecx + 0x20]
mov dword [ecx + 0xc4], eax
sub ebx, 1
jne 0x45a8d0
pop edi
pop esi
pop ebx
ret