joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a6f5
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5779db
call fcn.004fb967
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [esi + 4]
or ecx, 0x20006
push ecx
push ebx
push eax
push dword [esi + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43a74a
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, ebx
call fcn.004fba3f
ret 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43a766
mov dword [ebp - 0x14], ebx
cmp dword [esi + 0xc], ebx
jne 0x43a774
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 2
mov ebx, dword [ebp - 0x14]
jmp 0x43a731

Function at 0x43aa5d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x81c
mov eax, 0x577aeb
call fcn.004fb9d0
mov eax, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x818]
push edx
mov edx, dword [eax + 4]
or edx, 0x20019
push edx
mov dword [ebp - 0x828], ecx
mov ecx, dword [eax + 0x10]
xor esi, esi
push esi
push ecx
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43aaa6
xor eax, eax
call fcn.004fba53
ret 4
push 0x602968
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x814], esi
call fcn.00431ef7
mov dword [ebp - 4], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
jmp 0x43ab36
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x820]
call fcn.0043479c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x828]
lea eax, [ebp - 0x820]
push eax
call fcn.00433b89
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x820]
add ecx, 0xfffffff0
call fcn.004310e3
inc dword [ebp - 0x814]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x814]
push dword [ebp - 0x818]
mov dword [ebp - 0x81c], 0x80
call edi
test eax, eax
je 0x43aade
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43ab7c
mov dword [ebp - 4], 4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x824]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, esi
jmp 0x43aa9e
mov dword [ebp - 4], 5
xor esi, esi
inc esi
jmp 0x43ab63
Function at 0x43c3ee
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push 0x10
mov eax, 0x57808d
call fcn.004fb99a
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0x20
push 0xf0000000
push 0x18
push esi
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, esi
je 0x43c490
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, esi
je 0x43c490
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, esi
je 0x43c490
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, esi
je 0x43c490
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp eax, esi
je 0x43c490
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp eax, esi
je 0x43c490
xor eax, eax
inc eax
jmp 0x43c492
xor eax, eax
call fcn.004fba3f
ret

Function at 0x43c7d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x578106
call fcn.004fb967
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ecx + 0x10]
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ecx + 4]
xor edi, edi
inc edi
or edx, edi
push edx
push esi
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c81f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
or eax, 0xffffffff
call fcn.004fba3f
ret 4
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x43c861
mov dword [ebp - 4], 2
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, esi
jmp 0x43c817
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 3
jmp 0x43c84e
Function at 0x43c86d
Capabilities:
Set registry value

Disassembly:
push 0x20c
mov eax, 0x578161
call fcn.004fb9d0
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0xfe
mov dword [ebp - 0x218], edi
jle 0x43c8be
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
call fcn.004fba53
ret 8
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [esi + 4]
or ecx, 0x20006
push ecx
xor ebx, ebx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c919
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov dword [ebp - 4], 5
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, ebx
jmp 0x43c8b6
lea eax, [ebp - 0x210]
push eax
call fcn.004fb22e
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43c94d
mov dword [ebp - 0x218], ebx
cmp dword [esi + 0xc], ebx
jne 0x43c95e
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov dword [ebp - 4], 7
mov ebx, dword [ebp - 0x218]
jmp 0x43c906
Function at 0x43c98a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5781c1
call fcn.004fb967
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 3
pop edi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], edi
call fcn.004324a9
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00432aca
mov dword [ebp - 0x18], eax
cmp eax, 8
je 0x43ca07
cmp eax, 9
je 0x43ca07
cmp eax, 0xa
je 0x43ca07
cmp eax, ebx
je 0x43ca07
cmp eax, 0xb
je 0x43ca07
cmp eax, edi
je 0x43ca07
cmp eax, 7
je 0x43ca07
cmp eax, 2
je 0x43ca07
cmp eax, 6
je 0x43ca07
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
call fcn.004fba3f
ret 8
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [esi + 4]
or ecx, 0x20019
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43ca29
jmp 0x43c9ee
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x43ca50
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43c9ee
push dword [ebp - 0x10]
call fcn.004f8908
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x43caa3
push dword [ebp - 0x1c]
call fcn.004fc324
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 5
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, edi
jmp 0x43c9ff
push dword [ebp - 0x10]
call fcn.004f8908
mov esi, dword [ebp + 0xc]
mov edi, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
pop ecx
mov dword [esi], eax
cmp eax, ebx
jle 0x43cacf
mov ecx, dword [ebp - 0x1c]
mov eax, edi
sub ecx, edi
mov bl, byte [ecx + eax]
mov byte [eax], bl
inc edx
inc eax
cmp edx, dword [ebp - 0x10]
jl 0x43cac3
push dword [ebp - 0x1c]
call fcn.004fc324
mov eax, dword [ebp - 0x10]
pop ecx
push dword [ebp - 0x14]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 6
jmp 0x43ca8d
Function at 0x43cc71
Capabilities:
Get file version info

Disassembly:
push 0x228
mov eax, 0x578235
call fcn.004fb9d0
mov eax, dword [ebp + 8]
mov esi, ecx
xor edi, edi
push 0x602968
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], edi
call fcn.00431ef7
push 2
pop ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
cmp esi, edi
jne 0x43ccc2
push 0x208
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x43ccca
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x228], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x234], eax
cmp eax, edi
je 0x43cdbc
push eax
push ebx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x43cd2c
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call fcn.004324a9
mov dword [ebp - 0x224], 1
jmp 0x43cdd8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push esi
push dword [ebp - 0x234]
lea eax, [ebp - 0x218]
push dword [ebp - 0x228]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x59a764
push esi
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x22c], edi
je 0x43cdf5
mov eax, dword [ebp - 0x230]
cmp eax, edi
je 0x43cdf5
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov si, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, si
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
lea eax, [ebp - 0x21c]
push str._d._d._d._d
push eax
call fcn.00433c96
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call fcn.004324a9
mov dword [ebp - 0x224], 1
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [ebp - 0x220]
call fcn.004fba53
ret
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call fcn.004324a9
mov dword [ebp - 0x224], 1
jmp 0x43cdd8

Function at 0x43ce13
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x57825d
call fcn.004fba06
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004fc1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x43cebf
lea eax, [ebp - 0x21c]
push eax
call fcn.004fb22e
pop ecx
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x21e]
jne 0x43ce86
lea eax, [ebp - 0x21c]
push eax
call fcn.004fb22e
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 - 0x21e], cx
call fcn.0043129c
test eax, eax
lea eax, [ebp - 0x21c]
je 0x43ce9c
push str.SysWOW64_
jmp 0x43cea1
push str.System32_
push eax
push 0x59b56c
push esi
call fcn.00433c96
add esp, 0x10
xor eax, eax
inc eax
jmp 0x43cec1
xor eax, eax
call fcn.004fba62
ret
Function at 0x43d17d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x81c
mov eax, 0x5783e1
call fcn.004fb9d0
mov eax, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x818]
push edx
mov edx, dword [eax + 4]
or edx, 0x20019
push edx
mov dword [ebp - 0x828], ecx
mov ecx, dword [eax + 0x10]
xor esi, esi
push esi
push ecx
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43d1c6
xor eax, eax
call fcn.004fba53
ret 4
push 0x602968
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x814], esi
call fcn.00431ef7
mov dword [ebp - 4], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
jmp 0x43d256
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x820]
call fcn.0043479c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x828]
lea eax, [ebp - 0x820]
push eax
call fcn.00433b89
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x820]
add ecx, 0xfffffff0
call fcn.004310e3
inc dword [ebp - 0x814]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x814]
push dword [ebp - 0x818]
mov dword [ebp - 0x81c], 0x400
call edi
test eax, eax
je 0x43d1fe
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43d29c
mov dword [ebp - 4], 4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x824]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, esi
jmp 0x43d1be
mov dword [ebp - 4], 5
xor esi, esi
inc esi
jmp 0x43d283
Function at 0x44bf91
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
lea eax, [esi + 0x10]
push 0
push eax
call fcn.004fc1f0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret

Function at 0x44d17a
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], vtable.CMD5Checksum.0
call fcn.004fc1f0
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x44e6a2
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e779
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e780
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret