joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [ecx + 0x150]
and eax, 0xf
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x4c3c4b
mov edx, 0x10
sub edx, eax
cmp edx, ebx
cmova edx, ebx
xor esi, esi
mov dword [ebp + 0x10], edx
test edx, edx
je 0x4c3c17
lea edx, [ecx + 0x178]
mov ecx, dword [ebp + 0x10]
add edx, eax
mov al, byte [esi + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc esi
cmp esi, ecx
jb 0x4c3c00
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add eax, edx
lea esi, [ecx + 0x178]
mov dword [ebp - 4], esi
cmp eax, 0x10
jne 0x4c3c38
push esi
push esi
push ecx
call fcn.004c3150
mov ecx, dword [ebp + 8]
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ecx + 0x150], edx
adc dword [ecx + 0x154], 0
sub ebx, edx
add edi, edx
jmp 0x4c3c54
lea esi, [ecx + 0x178]
mov dword [ebp - 4], esi
add dword [ecx + 0x150], ebx
adc dword [ecx + 0x154], 0
cmp ebx, 0x10
jb 0x4c3cd6
add ecx, 0x179
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp + 0x10], eax
nop word [eax + eax]
lea edx, [edi + 2]
mov eax, ecx
mov esi, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub esi, 1
jne 0x4c3c90
mov esi, dword [ebp - 4]
push esi
push esi
push dword [ebp + 8]
call fcn.004c3150
mov ecx, dword [ebp - 8]
add esp, 0xc
sub ebx, 0x10
add edi, 0x10
sub dword [ebp + 0x10], 1
jne 0x4c3c80
test ebx, ebx
je 0x4c3cef
nop word [eax + eax]
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [esi], al
lea esi, [esi + 1]
sub ebx, 1
jne 0x4c3ce0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x55ca98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x30]
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x14]
push edi
push ebx
push eax
push dword [ebp + 0x20]
mov dword [ebp - 0x18], ebx
push ecx
push dword [ebp + 0x18]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004c3d00
mov edi, dword [ebp + 0x30]
add esp, 0x2c
test eax, eax
jne 0x4c3fd0
mov ebx, dword [ebp + 0x2c]
xor esi, esi
xor al, al
test edi, edi
je 0x4c3f88
cmp edi, 8
jb 0x4c3f88
mov edx, edi
xorps xmm4, xmm4
and edx, 0xfffffff8
xorps xmm3, xmm3
xor ecx, ecx
nop word [eax + eax]
movd xmm2, dword [ecx + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + ecx - 0x14]
lea ecx, [eax + 4]
punpcklbw xmm2, xmm0
add al, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, cl
por xmm4, xmm2
movd xmm2, dword [ecx + ebx]
movd xmm1, dword [ebp + ecx - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, al
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, edx
jb 0x4c3f10
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
movzx ecx, al
cmp ecx, edi
jae 0x4c3fa6
nop
movzx edx, byte [ecx + ebx]
inc al
movzx ecx, byte [ebp + ecx - 0x14]
xor edx, ecx
movzx ecx, al
or esi, edx
cmp ecx, edi
jb 0x4c3f90
test esi, esi
je 0x4c3fce
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.004ae790
add esp, 8
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005091c5
mov esp, ebp
pop ebp
ret
Function at 0x4c40c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55ca98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
push eax
push 0x10
lea eax, [edi + 0x10]
mov dword [ebp - 0x24], 0
push eax
lea eax, [edi + 0x20]
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.004b31a0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4c412f
or dword [edi + 0x78], 0x10
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004ae790
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
xor ebx, ebx
test edx, edx
je 0x4c422b
mov edi, dword [ebp + 0x14]
cmp edx, 0x40
jb 0x4c4205
lea eax, [edi - 1]
lea ecx, [edx - 1]
add eax, edx
add ecx, esi
cmp esi, eax
ja 0x4c415e
cmp ecx, edi
jae 0x4c4205
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x1c], eax
lea eax, [ecx + edx]
lea eax, [ebp + eax - 0x15]
cmp esi, eax
ja 0x4c4182
lea eax, [edx - 1]
add eax, esi
cmp eax, dword [ebp - 0x1c]
jae 0x4c4205
mov eax, edx
lea esi, [edi + 0x30]
and eax, 0xffffffc0
lea edx, [ebp - 4]
mov dword [ebp - 0x20], eax
add ecx, edx
mov eax, dword [ebp - 0x18]
mov edx, edi
add eax, 0x10
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
movups xmm0, xmmword [esi - 0x30]
add ebx, 0x40
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [eax - 0x50], xmm1
movups xmm1, xmmword [edi + eax - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x50]
movups xmmword [eax - 0x40], xmm1
movups xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, dword [ebp - 0x20]
jb 0x4c41a6
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x20], ebx
cmp ebx, edx
jae 0x4c422b
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + ebx]
sub edi, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
add eax, ebx
add esi, eax
sub edx, ebx
mov al, byte [edi + ecx]
lea esi, [esi + 1]
xor al, byte [esi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x4c4217
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004ae790
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.005091c5
mov esp, ebp
pop ebp
ret
Function at 0x4c47e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0x78]
test cl, 0x10
jne 0x4c4993
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4c497f
test cl, 8
jne 0x4c4993
mov edx, dword [esi + 0x68]
test cl, 4
jne 0x4c482c
cmp ebx, edx
ja 0x4c4993
mov al, byte [esi + 0x69]
xor byte [esi], al
xor byte [esi + 1], dl
or ecx, 4
mov dword [esi + 0x78], ecx
jmp 0x4c4840
mov eax, dword [esi + 0x70]
add eax, ebx
cmp eax, edx
ja 0x4c4993
nop dword [eax]
mov edx, dword [esi + 0x70]
mov eax, 0x10
add edx, 2
mov ecx, ebx
and edx, 0xf
sub eax, edx
mov dword [ebp - 4], edx
cmp eax, ebx
cmovbe ecx, eax
xor bl, bl
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4c490e
cmp ecx, 0x40
jb 0x4c490e
mov edi, dword [ebp + 0xc]
dec cl
lea eax, [edx + ecx]
movzx ecx, cl
movzx eax, al
add ecx, edi
add eax, esi
mov dword [ebp - 8], eax
movzx eax, dl
add eax, esi
cmp eax, ecx
ja 0x4c4893
cmp dword [ebp - 8], edi
jae 0x4c490b
mov eax, dword [ebp + 8]
mov bh, 0x20
and eax, 0xffffffc0
xor ecx, ecx
mov dword [ebp - 8], eax
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
add bl, 0x40
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
mov al, bh
sub al, 0x10
movzx ecx, al
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
movzx ecx, bh
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
lea eax, [ecx + edx]
movups xmm0, xmmword [eax + esi]
movups xmm1, xmmword [ecx + edi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
mov al, bh
add bh, 0x40
add al, 0x10
movzx ecx, al
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
movzx ecx, bl
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
cmp ecx, dword [ebp - 8]
jb 0x4c48a0
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 4]
movzx edx, bl
cmp edx, ecx
jae 0x4c4930
mov eax, dword [ebp + 0xc]
lea ecx, [edx + edi]
inc bl
mov al, byte [edx + eax]
xor byte [ecx + esi], al
mov ecx, dword [ebp + 8]
movzx edx, bl
cmp edx, ecx
jb 0x4c4918
mov edx, dword [esi + 0x70]
lea eax, [ecx + edi]
mov ebx, dword [ebp + 0x10]
add edx, ecx
add dword [ebp + 0xc], ecx
sub ebx, ecx
mov dword [esi + 0x70], edx
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
je 0x4c4950
cmp edx, dword [esi + 0x68]
jne 0x4c496b
lea eax, [ebp - 0xc]
push eax
push esi
push 0x10
lea eax, [esi + 0x20]
push esi
push eax
call fcn.004b31a0
add esp, 0x14
test eax, eax
jne 0x4c4988
mov edx, dword [esi + 0x70]
test ebx, ebx
jne 0x4c4840
cmp edx, dword [esi + 0x68]
jne 0x4c497f
or dword [esi + 0x78], 8
mov dword [esi + 0x70], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
or dword [esi + 0x78], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffff3
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca260
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x18
movzx esi, byte [eax + 0x538788]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x538888]
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x538988]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x538688]
or esi, eax
mov eax, ebx
shr eax, 0x18
mov edx, esi
rol edx, 8
movzx ecx, byte [eax + 0x538688]
mov eax, ebx
shr eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x538788]
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x538888]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x538988]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x4cbb30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push 0x538e80
push 0x538d80
mov eax, dword [edx]
xor eax, dword [ecx]
mov dword [ebp + 0xc], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov dword [ebp + 0x10], eax
mov eax, dword [edx + 8]
xor eax, dword [ecx + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ecx + 0xc]
push 0x538c80
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str.cw
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004cbcd0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004cb9c0
mov edx, dword [ebp + 0x14]
add esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [edx]
xor eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [edx + 4]
xor eax, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
xor eax, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret

Function at 0x4cbbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x14]
sub esp, 0xc
push ebx
mov bl, al
shr eax, 5
push esi
and bl, 0x1f
push edi
and eax, reloc.WS2_32.dll_closesocket
jns 0x4cbbf1
dec eax
or eax, 0xfffffffc
inc eax
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
movzx eax, al
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 4
mov edx, dword [esi + eax*4]
mov eax, edx
mov ecx, edx
and eax, 0xff0000
shr ecx, 0x10
xor eax, ecx
mov ecx, edx
shl ecx, 0x10
and edx, 0xff00
xor ecx, edx
shr eax, 8
shl ecx, 8
mov dl, bl
xor eax, ecx
mov cl, 0x20
sub cl, bl
neg dl
sbb dl, dl
and dl, cl
movzx ecx, dl
mov dword [ebp - 0xc], ecx
movzx ecx, bl
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
sub ebx, edi
mov ecx, dword [ebp + 0x14]
lea edi, [edi + 4]
inc cl
and cl, 3
mov dword [ebp + 0x14], ecx
movzx ecx, cl
mov edx, dword [esi + ecx*4]
mov esi, edx
mov ecx, edx
and esi, 0xff0000
shr ecx, 0x10
xor esi, ecx
mov ecx, edx
shl ecx, 0x10
and edx, 0xff00
xor ecx, edx
shr esi, 8
shl ecx, 8
xor esi, ecx
mov ecx, dword [ebp - 8]
shl eax, cl
mov edx, esi
mov ecx, dword [ebp - 0xc]
shr edx, cl
or eax, edx
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
xor edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
xor ecx, eax
shr edx, 8
shl ecx, 8
mov eax, esi
mov esi, dword [ebp + 0x10]
xor edx, ecx
xor edx, dword [ebx + edi - 4]
sub dword [ebp - 4], 1
mov dword [edi - 4], edx
jne 0x4cbc47
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
xor ecx, ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x4e4396
cmp ebx, 8
jb 0x4e4396
cmp dword [0x562fb4], 2
jl 0x4e4396
mov eax, ebx
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esi + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [esi + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x4e4350
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edi, xmm1
mov dword [esp + 0x10], edi
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ecx, ebx
jae 0x4e43ee
mov eax, ebx
sub eax, ecx
cmp eax, 2
jb 0x4e43dc
lea eax, [ebx - 1]
xor ebx, ebx
mov edi, eax
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi + ecx*4 + 4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cmp ecx, edi
jb 0x4e43b0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
cmp eax, dword [esp + 0x24]
jae 0x4e43e6
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov ecx, dword [esp + 0x14]
add ecx, ebp
add edi, ecx
mov eax, 1
test edi, edi
cmove edi, eax
mov eax, edi
cdq
push edx
push eax
call fcn.004fad20
add esp, 8
add eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4e4420
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
xor ecx, ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x4e44a6
cmp ebx, 8
jb 0x4e44a6
cmp dword [0x562fb4], 2
jl 0x4e44a6
mov eax, ebx
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esi + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [esi + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x4e4460
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edi, xmm1
mov dword [esp + 0x10], edi
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ecx, ebx
jae 0x4e44fe
mov eax, ebx
sub eax, ecx
cmp eax, 2
jb 0x4e44ec
lea eax, [ebx - 1]
xor ebx, ebx
mov edi, eax
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi + ecx*4 + 4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cmp ecx, edi
jb 0x4e44c0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
cmp eax, dword [esp + 0x24]
jae 0x4e44f6
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov ecx, dword [esp + 0x14]
add ecx, ebp
add edi, ecx
mov eax, 1
test edi, edi
cmove edi, eax
mov eax, edi
cdq
push edx
push eax
call fcn.004fad20
mov edx, dword [esp + 0x24]
add esp, 8
mov ecx, edx
sub ecx, dword [esp + 0x28]
add eax, ecx
pop edi
pop esi
pop ebp
pop ebx
cmp edx, eax
jle 0x4e4530
lea eax, [edx + 1]
add esp, 8
ret
inc eax
add esp, 8
ret
Function at 0x4f63c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 8
jl 0x4f6475
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [ebp + 8]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x53d820]
xor edx, dword [ecx*4 + 0x53d420]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x53dc20]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x53c420]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x53c820]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x53c020]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x53cc20]
xor edx, dword [eax*4 + 0x53d020]
mov eax, edx
sub ebx, 1
jne 0x4f63e4
pop ebx
jmp 0x4f6478
mov eax, dword [ebp + 8]
test edi, edi
je 0x4f649c
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x53c020]
sub edi, 1
jne 0x4f6480
pop edi
pop esi
pop ebp
ret

Function at 0x4f9a60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004faa70
mov edi, dword [esi + 0x14]
add esp, 4
test edi, edi
je 0x4f9ad2
mov ecx, dword [esi + 0x10]
mov eax, dword [esi]
mov edx, dword [esi + 0x20]
push ebp
mov ebp, dword [eax + ecx*4]
cmp edx, edi
jae 0x4f9aca
push ebx
mov ebx, dword [esi + 0x18]
nop word [eax + eax]
mov ecx, 0x18
mov eax, ebp
sub ecx, edx
add edx, 8
shr eax, cl
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x53e028]
xor ebx, ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], ebx
cmp edx, edi
jb 0x4f9a90
mov ax, bx
pop ebx
pop ebp
pop edi
pop esi
ret
mov ax, word [esi + 0x18]
pop ebp
pop edi
pop esi
ret
mov ax, word [esi + 0x18]
pop edi
pop esi
ret

Function at 0x4fab20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
cmp edi, 8
jb 0x4fabc0
push ebx
mov ebx, edi
shr ebx, 3
nop dword [eax + eax]
movzx edx, byte [esi]
sub edi, 8
movzx ecx, byte [esi + 1]
movzx eax, ax
shl edx, 8
or edx, ecx
xor edx, eax
movzx eax, byte [esi + 6]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x53ee28]
xor cx, word [eax*2 + 0x53e228]
movzx eax, byte [esi + 5]
xor cx, word [eax*2 + 0x53e428]
movzx eax, byte [esi + 4]
xor cx, word [eax*2 + 0x53e628]
movzx eax, byte [esi + 3]
xor cx, word [eax*2 + 0x53e828]
movzx eax, byte [esi + 7]
xor cx, word [eax*2 + 0x53e028]
movzx eax, byte [esi + 2]
add esi, 8
xor cx, word [eax*2 + 0x53ea28]
movzx eax, dl
xor cx, word [eax*2 + 0x53ec28]
movzx eax, cx
sub ebx, 1
jne 0x4fab40
pop ebx
test edi, edi
je 0x4fabe5
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, ax
shr edx, 8
xor edx, ecx
shl eax, 8
xor ax, word [edx*2 + 0x53e028]
movzx eax, ax
sub edi, 1
jne 0x4fabc4
pop edi
pop esi
ret
Function at 0x4fabf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp esi, 2
jb 0x4fac9d
push ebp
mov ebp, esi
shr ebp, 1
nop dword [eax]
mov ebx, dword [edi]
sub esi, 2
mov edx, dword [edi + 4]
movzx eax, ax
shr ebx, 0x10
xor ebx, eax
mov eax, dword [edi]
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
movzx eax, al
mov cx, word [ecx*2 + 0x53ea28]
xor cx, word [eax*2 + 0x53e428]
mov eax, edx
shr eax, 8
movzx eax, al
xor cx, word [eax*2 + 0x53e228]
mov eax, ebx
shr eax, 8
xor cx, word [eax*2 + 0x53ee28]
mov eax, edx
shr eax, 0x18
xor cx, word [eax*2 + 0x53e628]
movzx eax, bl
xor cx, word [eax*2 + 0x53ec28]
mov eax, dword [edi]
add edi, 8
movzx eax, al
xor cx, word [eax*2 + 0x53e828]
movzx eax, dl
xor cx, word [eax*2 + 0x53e028]
movzx eax, cx
sub ebp, 1
jne 0x4fac10
pop ebp
test esi, esi
je 0x4face3
mov ebx, dword [edi]
movzx eax, ax
shr ebx, 0x10
xor ebx, eax
mov eax, dword [edi]
shr eax, 8
mov ecx, ebx
movzx eax, al
shr ecx, 8
mov dx, word [eax*2 + 0x53e228]
xor dx, word [ecx*2 + 0x53e628]
movzx eax, bl
xor dx, word [eax*2 + 0x53e428]
mov eax, dword [edi]
movzx eax, al
xor dx, word [eax*2 + 0x53e028]
movzx eax, dx
pop edi
pop esi
pop ebx
ret

Function at 0x4facf0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x4fad17
push esi
mov esi, dword [esp + 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x53f028]
sub edx, 1
jne 0x4fad00
pop esi
ret
Function at 0x50a33c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x50a37b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50a37b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50a37b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x50a37b
cmp dword [ecx + 0x74], 0xe
jbe 0x50a37b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402a28
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423f10]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402abc
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a79
cmp dword [ebp + 0x10], ebx
jne 0x402ab0
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a28
test eax, eax
jne 0x402a8b
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a60
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405bd8
cmp eax, ebx
je 0x402ac3
push ebx
push dword [0x423f10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402abc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x423f10], ebx
jne 0x402ab9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ab9
jmp 0x402abc