joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push ecx
push esi
push 1
push eax
mov dword [ebp - 0x88], ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ebx, dword [ebp + 0x14]
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x8c], edi
cmp edi, esi
je 0x4b1960
mov esi, dword [ebp - 0x88]
test bl, 0x1a
je 0x4b191b
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 4
test eax, eax
je 0x4b18c2
push esi
call fcn.004ced90
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, eax
call edi
mov esi, eax
call edi
push dword [esi]
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0049a2b0
add esp, 0x10
push eax
push dword [edi]
push ebx
call fcn.004cec40
add esp, 4
push eax
push 0
push 2
jmp 0x4b1904
test bl, 6
je 0x4b191b
push esi
call fcn.004ced90
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, eax
call edi
mov esi, eax
call edi
push dword [esi]
mov edi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0049a2b0
add esp, 0x10
push eax
push dword [edi]
push ebx
call fcn.004cec40
add esp, 4
push eax
push 0
push 9
call fcn.0049a080
mov esi, dword [ebp - 0x88]
add esp, 0x14
mov edi, dword [ebp - 0x8c]
mov ebx, dword [ebp + 0x14]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
je 0x4b1930
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
jmp 0x4b1933
or eax, 0xffffffff
push eax
call fcn.004a3610
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 8
test eax, eax
jne 0x4b194c
test bl, 6
je 0x4b1963
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
test bl, 6
mov ecx, dword [ebp - 4]
mov eax, 0
cmovne edi, eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
Function at 0x4b6d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaf08
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 0x4c]
lea esi, [esi + 1]
shr esi, 1
push esi
mov dword [ebp - 0x10], esi
call fcn.004e0000
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.004e0000
mov edi, dword [ebp + 0x1c]
lea ecx, [ebp - 0x1c]
mov ebx, dword [ebp + 0x24]
mov byte [ebp - 4], 1
lea eax, [edi + ebx]
push eax
call fcn.004e0000
push esi
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
push esi
mov byte [ebp - 4], 2
call fcn.004e0300
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
and eax, 1
push ecx
sub ecx, eax
add ecx, esi
push ecx
lea ecx, [ebp - 0x40]
call fcn.004e0300
push edi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x1c]
call fcn.004e0300
push ebx
push dword [ebp + 0x20]
lea ecx, [ebp - 0x1c]
call fcn.004e0300
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
push ebx
call fcn.004e0000
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004e0000
push 1
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004b8720
push 2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b8720
add esp, 0x20
lea ecx, [ebp - 0x34]
push 0
call fcn.004c5ba0
push 0
lea ecx, [ebp - 0x28]
call fcn.004c5ba0
xor esi, esi
test ebx, ebx
je 0x4b6ec9
mov ebx, dword [ebp + 8]
nop word [eax + eax]
push 0xfeedbeef
lea ecx, [ebp - 0x28]
call fcn.004e00c0
push 0xfeedbeef
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004e00c0
mov cl, byte [edi]
xor cl, byte [eax]
mov byte [esi + ebx], cl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4b6ea0
lea ecx, [ebp - 0x28]
call fcn.004c4f40
lea ecx, [ebp - 0x34]
call fcn.004c4f40
lea ecx, [ebp - 0x1c]
call fcn.004c4f40
lea ecx, [ebp - 0x40]
call fcn.004c4f40
lea ecx, [ebp - 0x4c]
call fcn.004c4f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4beea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb6c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x25c
mov dword [ebp - 4], 0
mov dword [esi], vtable.yaSSL::AES.0
call fcn.004e7e10
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
test edx, edx
je 0x4bef77
mov dword [edx + 4], 0x10
lea ecx, [edx + 0x10]
mov dword [edx + 8], ecx
lea eax, [edx + 0x13c]
mov dword [edx + 0x30], 0
lea ecx, [edx + 0x20]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x34], 1
mov dword [edx], vtable.TaoCrypt::AES.0
mov dword [edx + 0x134], eax
lea eax, [edx + 0x14c]
mov dword [edx + 0x138], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x130], 0x10
mov dword [edx + 0x15c], 1
mov dword [edx + 0x160], 1
mov dword [edx + method.TaoCrypt::AES.virtual_0], vtable.TaoCrypt::AES.0
mov dword [edx + 0x258], eax
mov eax, esi
mov dword [esi + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4befa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb6c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x170
mov dword [ebp - 4], 0
mov dword [esi], vtable.yaSSL::DES.0
call fcn.004e7e10
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
test edx, edx
je 0x4bf068
mov dword [edx + 4], 8
lea ecx, [edx + 0x10]
mov dword [edx + 8], ecx
lea eax, [edx + 0xc8]
mov dword [edx + 0x30], 0
lea ecx, [edx + 0x20]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x34], 1
mov dword [edx], vtable.TaoCrypt::DES.0
mov dword [edx + 0xc0], eax
lea eax, [edx + 0xd8]
mov dword [edx + 0xc4], eax
mov eax, esi
mov dword [edx + 0xbc], 8
mov dword [edx + 0xe8], 1
mov dword [edx + 0xec], 1
mov dword [edx + 0xb8], vtable.TaoCrypt::DES.0
mov dword [esi + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bf090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb6c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x370
mov dword [ebp - 4], 0
mov dword [esi], vtable.yaSSL::DES_EDE.0
call fcn.004e7e10
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
test edx, edx
je 0x4bf158
mov dword [edx + 4], 8
lea ecx, [edx + 0x10]
mov dword [edx + 8], ecx
lea eax, [edx + 0x1c8]
mov dword [edx + 0x30], 0
lea ecx, [edx + 0x20]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x34], 1
mov dword [edx], vtable.TaoCrypt::DES_EDE3.0
mov dword [edx + 0x1c0], eax
lea eax, [edx + 0x1d8]
mov dword [edx + 0x1c4], eax
mov eax, esi
mov dword [edx + 0x1bc], 8
mov dword [edx + 0x1e8], 1
mov dword [edx + 0x1ec], 1
mov dword [edx + method.TaoCrypt::DES_EDE3.virtual_0], vtable.TaoCrypt::DES_EDE3.0
mov dword [esi + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c1020
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
call dword [eax + 0xc]
mov edi, dword [ebp + 0xc]
mov byte [esi + 0xc], 0
push edi
push dword [ebp + 8]
cmp edi, 0x40
ja 0x4c104d
push dword [esi]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4c1066
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
call dword [eax + 4]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push dword [esi]
call dword [eax + 8]
mov edi, 0x10
mov eax, 0x40
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esi + 4]
add esp, 0xc
mov edx, dword [esi]
xor eax, eax
lea edi, [ecx + 0x3f]
cmp edx, edi
lea ebx, [edx + 0x3f]
lea edi, [esi + 4]
ja 0x4c1095
cmp ebx, ecx
jae 0x4c10b8
cmp edx, esi
ja 0x4c109d
cmp ebx, esi
jae 0x4c10b8
cmp edx, edi
ja 0x4c10a5
cmp ebx, edi
jae 0x4c10b8
lea ebx, [ecx + 0x3f]
cmp ecx, esi
ja 0x4c10b0
cmp ebx, esi
jae 0x4c10b8
cmp ecx, edi
ja 0x4c10d8
cmp ebx, edi
jb 0x4c10d8
mov ecx, dword [esi]
mov dl, byte [ecx + eax]
mov ecx, dword [edi]
xor dl, 0x5c
mov byte [eax + ecx], dl
mov ecx, dword [esi]
xor byte [ecx + eax], 0x36
inc eax
cmp eax, 0x40
jb 0x4c10b8
pop edi
pop esi
pop ebx
pop ebp
ret 8
movaps xmm2, xmmword [0x568000]
movaps xmm3, xmmword [str.6666666666666666_t]
nop word [eax + eax]
movups xmm0, xmmword [edx + eax]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ecx + eax], xmm0
movups xmm0, xmmword [edx + eax]
pxor xmm0, xmm3
movups xmmword [edx + eax], xmm0
movups xmm0, xmmword [edx + eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx + eax + 0x10], xmm1
movups xmm0, xmmword [edx + eax + 0x10]
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmmword [edx + eax + 0x10], xmm1
add eax, 0x20
cmp eax, 0x40
jb 0x4c10f0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4c1140
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
call dword [eax + 0xc]
mov edi, dword [ebp + 0xc]
mov byte [esi + 0xc], 0
push edi
push dword [ebp + 8]
cmp edi, 0x40
ja 0x4c116d
push dword [esi]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4c1186
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
call dword [eax + 4]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push dword [esi]
call dword [eax + 8]
mov edi, 0x14
mov eax, 0x40
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esi + 4]
add esp, 0xc
mov edx, dword [esi]
xor eax, eax
lea edi, [ecx + 0x3f]
cmp edx, edi
lea ebx, [edx + 0x3f]
lea edi, [esi + 4]
ja 0x4c11b5
cmp ebx, ecx
jae 0x4c11d8
cmp edx, esi
ja 0x4c11bd
cmp ebx, esi
jae 0x4c11d8
cmp edx, edi
ja 0x4c11c5
cmp ebx, edi
jae 0x4c11d8
lea ebx, [ecx + 0x3f]
cmp ecx, esi
ja 0x4c11d0
cmp ebx, esi
jae 0x4c11d8
cmp ecx, edi
ja 0x4c11f8
cmp ebx, edi
jb 0x4c11f8
mov ecx, dword [esi]
mov dl, byte [ecx + eax]
mov ecx, dword [edi]
xor dl, 0x5c
mov byte [eax + ecx], dl
mov ecx, dword [esi]
xor byte [ecx + eax], 0x36
inc eax
cmp eax, 0x40
jb 0x4c11d8
pop edi
pop esi
pop ebx
pop ebp
ret 8
movaps xmm2, xmmword [0x568000]
movaps xmm3, xmmword [str.6666666666666666_t]
nop word [eax + eax]
movups xmm0, xmmword [edx + eax]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ecx + eax], xmm0
movups xmm0, xmmword [edx + eax]
pxor xmm0, xmm3
movups xmmword [edx + eax], xmm0
movups xmm0, xmmword [edx + eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx + eax + 0x10], xmm1
movups xmm0, xmmword [edx + eax + 0x10]
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmmword [edx + eax + 0x10], xmm1
add eax, 0x20
cmp eax, 0x40
jb 0x4c1210
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4c1ed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebd73
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], vtable.TaoCrypt::CertDecoder.0
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
cmp byte [ebp + 0x14], 0
mov dword [esi + 0x10], 0
sete al
mov dword [esi + 0x14], 0
cmp byte [ebp + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x5c], 0
mov byte [esi + 0x484], al
mov byte [ebp - 4], 1
mov byte [esi + 0x60], 0
mov byte [esi + 0x260], 0
je 0x4c1f7f
push dword [ebp + 0x18]
push dword [ebp + 0x10]
call fcn.004c2ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4c61c0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret
Function at 0x4ceef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x4ceefe
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [0x7db268]
add ecx, ecx
push esi
push 0
lea esi, [ebp + 0x10]
push esi
push edx
push dword [ebp + 0xc]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
jne 0x4cef40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x4ceefa
cmp eax, 0x6d
je 0x4ceefa
push eax
call fcn.004d5ce0
add esp, 4
or eax, 0xffffffff
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop ebp
ret

Function at 0x4d1060
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x10], 0x6a09e667
mov dword [ecx + 0x14], 0xbb67ae85
mov dword [ecx + 0x18], 0x3c6ef372
mov dword [ecx + 0x1c], 0xa54ff53a
mov dword [ecx + 0x20], 0x510e527f
mov dword [ecx + 0x24], 0x9b05688c
mov dword [ecx + 0x28], 0x1f83d9ab
mov dword [ecx + 0x2c], 0x5be0cd19
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret

Function at 0x4d10b0
Capabilities:
Hash data using sha224

Disassembly:
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret

Function at 0x4d1140
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x10], 0xf3bcc908
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret

Function at 0x4d11d0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret
Function at 0x4de8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov eax, dword [0x82952c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax + ecx*4]
push edi
shr eax, 3
push eax
push 0
push ebx
lea ecx, [eax + ebx]
mov dword [ebp + 0x10], ecx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov eax, ebx
lea ecx, [edx + edi]
cmp edx, ecx
cmova edi, esi
test edi, edi
je 0x4de904
nop
cmp eax, dword [ebp + 0x10]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
cmove eax, ebx
inc esi
xor byte [eax], cl
inc eax
cmp esi, edi
jb 0x4de8f0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4de9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
xor ecx, ecx
test edx, edx
je 0x4dea40
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edx, 8
jb 0x4dea1f
lea eax, [edx - 1]
push ebx
lea eax, [esi + eax*4]
lea ebx, [edx - 1]
lea ebx, [edi + ebx*4]
cmp edi, eax
ja 0x4de9d3
cmp ebx, esi
jae 0x4dea1e
mov ebx, edx
lea eax, [edi + 0x10]
mov edx, esi
and ebx, 0xfffffff8
sub edx, edi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ecx*4]
add ecx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, ebx
jb 0x4de9f0
mov edi, dword [ebp + 8]
pop ebx
cmp ecx, edx
jae 0x4dea3e
sub esi, edi
lea eax, [edi + ecx*4]
sub edx, ecx
nop word [eax + eax]
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x4dea30
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dea50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, edi
or eax, esi
or eax, edx
test al, 3
jne 0x4dea7f
shr edx, 2
push edx
push esi
push edi
call fcn.004de9a0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test edx, edx
je 0x4deb0e
cmp edx, 0x20
jb 0x4deaf1
push ebx
lea eax, [esi - 1]
lea ebx, [edi - 1]
add eax, edx
add ebx, edx
cmp edi, eax
ja 0x4deaa1
cmp ebx, esi
jae 0x4deaf0
mov ebx, edx
mov eax, edi
mov edx, esi
and ebx, 0xffffffe0
sub edx, edi
mov dword [ebp - 4], edx
lea edx, [esi + 0x10]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
nop
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edi + ecx]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, ebx
jb 0x4deac0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
pop ebx
cmp ecx, edx
jae 0x4deb0e
sub esi, edi
lea eax, [ecx + edi]
sub edx, ecx
nop dword [eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x4deb00
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4deb20
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x30], 0
jne 0x4deb2f
pop ebp
jmp fcn.004df830
pop ebp
jmp fcn.004df160
Function at 0x4e23f0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x88], ecx
movzx edx, byte [esi + str.91__]
movzx ecx, byte [esi + 0x7b7f41]
dec edx
mov eax, edx
and edx, 7
sar eax, 3
movzx eax, byte [eax + edi]
test byte [edx*4 + 0x7b7fb8], al
setne al
dec ecx
mov byte [ebp + esi - 0x80], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + edi]
test byte [ecx*4 + 0x7b7fb8], al
movzx ecx, byte [esi + 0x7b7f42]
setne al
dec ecx
mov byte [ebp + esi - 0x7f], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + edi]
test byte [ecx*4 + 0x7b7fb8], al
movzx ecx, byte [esi + 0x7b7f43]
setne al
dec ecx
mov byte [ebp + esi - 0x7e], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + edi]
test byte [ecx*4 + 0x7b7fb8], al
setne al
mov byte [ebp + esi - 0x7d], al
add esi, 4
cmp esi, 0x38
jl 0x4e2410
push ebx
xor ebx, ebx
mov dword [ebp - 0x84], ebx
nop dword [eax]
movzx edi, byte [ebx + 0x7b7f78]
xorps xmm0, xmm0
movq qword [ebp - 0x10], xmm0
xor esi, esi
mov ebx, 0x1c
cmp esi, ebx
lea eax, [edi - 0x1c]
mov edx, 0x38
mov ecx, edi
cmovl edx, ebx
cmp edi, edx
cmovge ecx, eax
inc edi
mov al, byte [ebp + ecx - 0x80]
mov byte [ebp + esi - 0x48], al
inc esi
cmp esi, 0x38
jl 0x4e24c6
mov ebx, dword [ebp - 0x84]
xor ecx, ecx
movzx eax, byte [ecx + 0x7b7f88]
cmp byte [ebp + eax - 0x49], 0
je 0x4e2523
mov eax, 0xaaaaaaab
lea esi, [ebp - 0x10]
mul ecx
mov eax, ecx
shr edx, 2
add esi, edx
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
mov eax, dword [eax*4 + 0x7b7fb8]
sar eax, 2
or byte [esi], al
inc ecx
cmp ecx, 0x30
jl 0x4e24f1
movzx ecx, byte [ebp - 0x10]
movzx eax, byte [ebp - 0xe]
mov edi, dword [ebp - 0x88]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xd]
mov dword [edi + ebx*8], ecx
movzx ecx, byte [ebp - 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 9]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*8 + 4], ecx
inc ebx
mov dword [ebp - 0x84], ebx
cmp ebx, 0x10
jl 0x4e24b0
cmp dword [ebp + 0x10], 1
pop ebx
jne 0x4e25b5
xor esi, esi
lea edx, [edi + 0x7c]
mov ecx, dword [edi + esi*4]
lea edx, [edx - 8]
mov eax, dword [edx + 4]
mov dword [edi + esi*4], eax
mov dword [edx + 4], ecx
mov ecx, dword [edi + esi*4 + 4]
mov eax, dword [edx + 8]
mov dword [edi + esi*4 + 4], eax
add esi, 2
mov dword [edx + 8], ecx
cmp esi, 0x10
jl 0x4e2590
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e7e02
mov esp, ebp
pop ebp
ret 0xc