joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aef0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0042a4b0
mov dword [esp + 0x20], ebx
add esp, 0x18
pop ebx
jmp fcn.0042ab20

Function at 0x430c70
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x430d7b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x430d00
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x430c90
mov ecx, edx
jmp 0x430d3b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x430d43
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x430d2e
mov ecx, edx
xor eax, eax
jmp 0x430d3b

Function at 0x436a00
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x436a2e
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x436a17
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x436a2a

Function at 0x436a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x436a68
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x436a54
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret
Function at 0x44c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
cmp dword [esp + 0x20], 0xa
mov ebp, dword [esp + 0x1c]
jbe 0x44c6f1
movzx edx, byte [ebp]
not edx
mov eax, edx
shr al, 4
and eax, edx
movzx edx, byte [ebp + 1]
mov ecx, eax
shr cl, 2
mov byte [esp + 4], cl
and byte [esp + 4], al
xor edx, 0xfffffffd
movzx eax, byte [esp + 4]
shr al, 1
mov byte [esp + 6], al
mov eax, edx
shr al, 4
and eax, edx
mov edx, 2
mov ecx, eax
shr cl, 2
mov byte [esp + 5], cl
xor ecx, ecx
and byte [esp + 5], al
movzx eax, byte [esp + 5]
shr al, 1
mov byte [esp + 7], al
mov eax, 1
mov dword [esp], eax
movzx ebx, byte [ebp + edx]
not ebx
mov eax, ebx
shr al, 4
mov esi, eax
and esi, ebx
mov ebx, esi
shr bl, 2
and ebx, esi
mov eax, ebx
shr al, 1
mov esi, eax
and esi, ebx
mov eax, esi
mov esi, dword [esp]
movzx ebx, al
and esi, ebx
sub ebx, 1
lea edi, [esi - 1]
neg esi
and esi, edx
and ecx, edi
or ecx, esi
add edx, 1
and dword [esp], ebx
cmp edx, dword [esp + 0x20]
jne 0x44c670
mov eax, dword [esp]
movzx edx, byte [esp + 6]
and dl, byte [esp + 5]
and dl, byte [esp + 4]
and dl, byte [esp + 7]
not eax
mov edi, dword [esp + 0x24]
movzx edx, dl
and eax, edx
mov edx, 9
sub edx, ecx
add ecx, 1
shr edx, 0x1f
and eax, edx
mov edx, eax
neg edx
and edx, ecx
mov dword [edi], edx
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x24]
mov dword [eax], 0
add esp, 8
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x466430
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x466480
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x46647d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x466450
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x469650
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov edi, dword [esp + 0x140]
mov esi, dword [esp + 0x148]
test ebx, ebx
je 0x4697bf
cmp ebx, dword [edi]
je 0x4697c1
mov dword [esp], ebx
call fcn.00464190
cmp eax, esi
jb 0x469790
mov eax, dword [esp + 0x144]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], esi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x1c], esi
cmp esi, 0x80
je 0x4696d6
mov eax, pe_nt_image_headers32
sub eax, esi
add esi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x4696d8
mov eax, dword [esp + 0x150]
lea esi, [edi + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004644e0
test eax, eax
je 0x4697b2
mov dword [esp], ebx
call fcn.00464190
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00464630
test eax, eax
je 0x4697b2
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x469736
mov eax, dword [esp + 0x150]
lea ebp, [edi + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.004644e0
test eax, eax
je 0x4697b2
mov dword [esp], ebx
call fcn.00464190
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00464630
test eax, eax
je 0x4697b2
mov dword [edi], ebx
jmp 0x4697d3
mov edx, dword [esp + 0x150]
lea eax, [edi + 4]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call fcn.004644e0
test eax, eax
jne 0x4697ec
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x46967f
lea esi, [edi + 0x1c]
add edi, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00464310
test eax, eax
setne al
movzx eax, al
jmp 0x4697b4
mov eax, dword [esp + 0x144]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00464630
test eax, eax
je 0x4697b2
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
lea ebp, [esp + 0xa0]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00464660
test eax, eax
je 0x4697b2
mov esi, dword [esp + 0x1c]
jmp 0x4696b1
Function at 0x469bd0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
lea esi, [edi + 0x7e]
mov dword [esp + 0x18], eax
mov edi, 5
mov dword [esp + 0x10], 3
mov ecx, ebx
mov eax, edx
shr ebx, 0x10
shr edx, 0x10
mov word [esp], ax
movzx eax, word [esp]
rol dx, 0xb
sub esi, 8
rol word [esp], 0xd
mov ebp, eax
not ebp
and ebp, ecx
sub edx, ebp
mov ebp, eax
movzx eax, word [esi + 6]
and ebp, ebx
sub edx, ebp
mov ebp, ebx
sub dx, word [esi + 8]
not ebp
and ebp, edx
sub word [esp], bp
mov ebp, ebx
and ebp, ecx
sub word [esp], bp
mov ebp, ecx
sub word [esp], ax
not ebp
movzx eax, word [esp]
rol bx, 0xe
and ebp, eax
sub ebx, ebp
mov ebp, edx
and ebp, ecx
sub ebx, ebp
mov ebp, edx
sub bx, word [esi + 4]
not ebp
rol cx, 0xf
and ebp, ebx
sub ecx, ebp
mov ebp, eax
and ebp, edx
sub ecx, ebp
sub cx, word [esi + 2]
sub edi, 1
jne 0x469c04
sub dword [esp + 0x10], 1
je 0x469cc0
xor eax, eax
mov ebp, dword [esp]
cmp dword [esp + 0x10], 2
sete al
and ebp, 0x3f
mov edi, eax
mov eax, dword [esp + 0x14]
add edi, 5
sub dx, word [eax + ebp*2]
mov ebp, ebx
and ebp, 0x3f
movzx ebp, word [eax + ebp*2]
sub word [esp], bp
mov ebp, ecx
and ebp, 0x3f
sub bx, word [eax + ebp*2]
mov ebp, edx
and ebp, 0x3f
sub cx, word [eax + ebp*2]
jmp 0x469c04
movzx eax, word [esp]
shl ebx, 0x10
movzx ecx, cx
mov edi, dword [esp + 0x18]
shl edx, 0x10
or ebx, ecx
or edx, eax
mov dword [edi], ebx
mov dword [edi + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46fb30
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x46fb90
test edi, 2
jne 0x46fba0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x46fb61
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x46fb69
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x46fb4a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x46fb4a
Function at 0x473480
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x473500
test edi, 2
jne 0x473510
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4734b1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4734b9
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x47349a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47349a
Function at 0x473b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebx, dword [eax]
test ebx, ebx
je 0x473bdb
mov eax, dword [esp + 0x48]
test eax, eax
je 0x473bdb
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
jmp 0x473bb4
test ebp, ebp
je 0x473bcf
movzx eax, byte [edi + ebx]
add edx, 1
add ebx, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x473bb0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x48], 0xf
jbe 0x473cf1
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x54], edi
mov edi, ebp
mov ebp, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov eax, 0x10
sub eax, 1
add byte [esi + eax], 1
jne 0x473c41
test eax, eax
jne 0x473c22
cmp ebx, 0xf
ja 0x473c46
mov eax, dword [ecx + ebx]
xor eax, dword [edi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x473c34
sub dword [esp + 0x18], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0x18], 0xf
jbe 0x473c5c
xor ebx, ebx
jmp 0x473c02
mov eax, dword [esp + 0x48]
mov edi, ecx
xor ebx, ebx
mov ebp, dword [esp + 0x48]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x44], eax
add dword [esp + 0x40], eax
test ebp, ebp
jne 0x473c8e
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov eax, 0x10
sub eax, 1
movzx ecx, byte [esi + eax]
lea edx, [ecx + 1]
test dl, dl
mov byte [esi + eax], dl
jne 0x473cbb
test eax, eax
jne 0x473ca6
mov ecx, dword [esp + 0x44]
lea esi, [edi + ebx]
xor eax, eax
mov edi, dword [esp + 0x40]
add ecx, ebx
add edi, ebx
lea esi, [esi]
movzx edx, byte [esi + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x473cd0
add ebx, eax
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x48]
jmp 0x473c7c
Function at 0x473d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov eax, dword [eax]
mov ebx, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x473d54
test esi, esi
je 0x473d54
mov edx, eax
mov edi, dword [esp + 0x54]
jmp 0x473d35
test esi, esi
je 0x473d50
movzx eax, byte [edi + edx]
add ebp, 1
add edx, 1
xor al, byte [ebp - 1]
add ecx, 1
sub esi, 1
and edx, 0xf
mov byte [ecx - 1], al
jne 0x473d31
mov dword [esp + 0x1c], edx
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
cmp esi, 0xf
jbe 0x473ddd
mov edi, esi
shr edi, 4
mov edx, edi
add edx, eax
jae 0x473df3
neg eax
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
mov eax, 0xc
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xf], 0
nop
sub eax, 1
add byte [ebx + eax], 1
jne 0x473dcd
test eax, eax
jne 0x473dc0
xor eax, eax
shl edi, 4
sub esi, edi
add ecx, edi
add ebp, edi
cmp esi, 0xf
ja 0x473d78
test esi, esi
jne 0x473e3d
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, edx
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, edx
mov byte [ebx + 0xf], dl
jmp 0x473dcf
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 1
mov edx, eax
shr edx, 0x18
mov byte [ebx + 0xc], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0xd], dl
mov edx, eax
shr edx, 8
test eax, eax
mov byte [ebx + 0xe], dl
mov byte [ebx + 0xf], al
jne 0x473ec8
mov al, 0xc
sub eax, 1
movzx edi, byte [ebx + eax]
lea edx, [edi + 1]
test dl, dl
mov byte [ebx + eax], dl
jne 0x473ec8
test eax, eax
jne 0x473eb3
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x54]
add ecx, edi
add ebx, edi
add edi, ebp
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jne 0x473ed8
add dword [esp + 0x1c], eax
jmp 0x473de1
Function at 0x474a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
cmp dword [esp + 0x48], 0xc
mov ebp, dword [esp + 0x44]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x168], 0
je 0x474c06
mov eax, dword [esp + 0x48]
xor edx, edx
mov edi, ebp
mov esi, dword [esp + 0x48]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x474b2f
mov dword [esp + 0x44], ebp
mov ebp, esi
mov esi, dword [esp + 0x14]
nop
lea esi, [esi]
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x474af2
mov dword [esp + 4], esi
sub ebp, 0x10
add edi, 0x10
mov dword [esp], ebx
call fcn.00474040
cmp ebp, 0xf
ja 0x474af0
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x44]
and dword [esp + 0x48], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x474b5f
mov ecx, dword [esp + 0x48]
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, ecx
jne 0x474b40
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00474040
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
mov edi, edx
mov esi, eax
mov eax, esi
shrd eax, edx, 0x18
xor byte [ebx + 0xc], al
mov eax, esi
shrd eax, edi, 0x10
xor byte [ebx + 0xd], al
mov eax, esi
shrd eax, edi, 8
xor byte [ebx + 0xe], al
mov eax, esi
xor byte [ebx + 0xf], al
mov eax, dword [esp + 0x14]
xor byte [ebx + 0xb], dl
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00474040
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
lea esi, [eax + 1]
mov eax, dword [ebx + 0x174]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x20]
mov dword [esp + 4], eax
call dword [ebx + 0x170]
mov eax, esi
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, esi
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, esi
mov byte [ebx + 0xf], al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp]
mov esi, 2
mov dword [ebx], eax
mov eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov byte [ebx + 0xf], 1
mov dword [ebx + 8], eax
jmp 0x474bc7
Function at 0x474c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x474c65
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x474c6d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x474d63
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x474cd3
test edi, edi
jne 0x474c94
jmp 0x474cae
test edi, edi
je 0x474caa
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x474c90
test edx, edx
je 0x474cc1
mov dword [esi + 0x16c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x60]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00474040
cmp edi, 0xf
jbe 0x474d36
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x60]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x474cf6
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00474040
cmp ebx, 0xf
ja 0x474cf4
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x474d50
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x474d40
mov dword [esi + 0x16c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x474c73
xor eax, eax
jmp 0x474c65
Function at 0x475f10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.00475ae0
test eax, eax
js 0x47612e
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x475fa9
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x475f60
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x47612c
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x53fa00]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x53fa00]
mov edx, dword [edx*4 + 0x53e200]
xor edx, dword [esi*4 + 0x53ee00]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x53fa00]
movzx esi, cl
movzx esi, byte [esi*4 + 0x53fa00]
xor edx, dword [esi*4 + 0x53ea00]
xor edx, dword [ebx*4 + 0x53e600]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x53fa00]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x53fa00]
mov edx, dword [edx*4 + 0x53e200]
xor edx, dword [esi*4 + 0x53ee00]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x53fa00]
movzx esi, cl
movzx esi, byte [esi*4 + 0x53fa00]
xor edx, dword [esi*4 + 0x53ea00]
xor edx, dword [ebx*4 + 0x53e600]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x53fa00]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x53fa00]
mov edx, dword [edx*4 + 0x53e200]
xor edx, dword [esi*4 + 0x53ee00]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x53fa00]
movzx esi, cl
movzx esi, byte [esi*4 + 0x53fa00]
xor edx, dword [esi*4 + 0x53ea00]
xor edx, dword [ebx*4 + 0x53e600]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x53fa00]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x53fa00]
mov edx, dword [edx*4 + 0x53e200]
xor edx, dword [esi*4 + 0x53ee00]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x53fa00]
movzx esi, cl
movzx esi, byte [esi*4 + 0x53fa00]
xor edx, dword [esi*4 + 0x53ea00]
xor edx, dword [ebx*4 + 0x53e600]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x475fc0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret