joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1083000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1083131
push esi
call fcn.01086145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01075080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1083131
push 0
push ebp
call fcn.010753a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01075260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x108308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.010752f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1083121
push 0x109b918
push edi
call fcn.010843f0
push eax
push ebx
push esi
call fcn.01082f60
push 0x109b8f8
push edi
call fcn.010843f0
push eax
push ebx
push esi
call fcn.01082f60
push 0x109b8d8
push edi
call fcn.010843f0
push eax
push ebx
push esi
call fcn.01082f60
push 0x109b8c0
push edi
call fcn.010843f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01082f60
push 0x109b8a0
push edi
call fcn.010843f0
push eax
push ebx
push esi
call fcn.01082f60
push 0x109b888
push edi
call fcn.010843f0
push eax
push ebx
push esi
call fcn.01082f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10841b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01084140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01084140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01084140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01084140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1084bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1084c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x109687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1084c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1084c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4078e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ea3a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.0043fbe5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4079a0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0047994a
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x4ca6bc
push eax
call fcn.00478e24
push edi
push esi
call fcn.0043ff2d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret 4
Function at 0x411ca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f625
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4cc0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0
mov dword [edi], 0x4c0b80
mov dword [ebp - 0x18], edi
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.0040cbd0
lea eax, [ebp - 0x20]
mov dword [esi + 0x3c], 0
lea ebx, [edi + 0x10]
mov ecx, esi
push eax
mov dword [esi + 0x38], ebx
call fcn.0040cb80
push eax
mov dword [ebp - 4], 2
call fcn.00414020
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x411d70
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x411d70
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
push 0x20
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x411d99
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.0040caa0
mov dword [ebp - 4], 4
mov eax, dword [edi]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, ebx
call fcn.00413e90
lea eax, [ebx + 4]
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebx + 0x1c]
mov dword [ecx], 0
mov ecx, dword [ebx + 0x2c]
mov dword [ecx], 0
mov dword [ebx + 0x4c], 0
mov ecx, dword [0x4ce7e4]
mov dword [ebx + 0x40], ecx
mov ecx, dword [0x4ce7e8]
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f708
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41385d
cmp byte [ebx + 0x3d], 0
je 0x41385d
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x413779
xor al, al
jmp 0x41385f
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4137ee
sub eax, 1
je 0x4137f2
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x413845
xor bl, bl
jmp 0x413847
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x413827
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00481803
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x4137ea
cmp byte [ebx + 0x3d], 0
je 0x413845
test esi, esi
jne 0x4137b0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413340
jmp 0x4137a9
mov bl, 1
cmp ecx, 0x10
jb 0x413859
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00409a60
mov al, bl
jmp 0x41385f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
Function at 0x413e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ef06
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4cc0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00442331
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043fe2a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov eax, edx
mov dword [ebp - 4], ecx
mov edi, ecx
mov dword [ebp - 8], eax
lea ecx, [edi + eax]
mov dword [ebp - 0x1c], ecx
cmp edi, ecx
jae 0x41550f
push ebx
push esi
cmp eax, 8
jb 0x41550d
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [edi]
mov eax, dword [edi + 4]
mov edx, dword [ecx]
lea edi, [ebx + 0x10]
mov dword [ebp - 0x10], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
nop
mov edx, eax
lea ebx, [ebx - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp - 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
xor edx, ecx
lea ecx, [ebx + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 0x14]
shl ecx, 4
add ecx, dword [ebp - 0x18]
xor edx, ecx
lea ecx, [ebx + esi]
xor edx, ecx
add eax, edx
sub edi, 1
jne 0x4154b0
mov edi, dword [ebp - 4]
mov dword [edi], esi
mov dword [edi + 4], eax
add edi, 8
mov eax, dword [ebp - 8]
sub eax, 8
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 0x1c]
jb 0x415481
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x415520
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov eax, edx
mov dword [ebp - 4], ecx
mov edi, ecx
mov dword [ebp - 8], eax
lea ecx, [edi + eax]
mov dword [ebp - 0x1c], ecx
cmp edi, ecx
jae 0x4155d2
push ebx
push esi
cmp eax, 8
jb 0x4155d0
mov ecx, dword [ebp + 8]
mov ebx, 0xe3779b90
mov esi, dword [edi]
mov eax, dword [edi + 4]
mov edi, 0x10
mov edx, dword [ecx + 8]
mov dword [ebp - 0x10], edx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
xor edx, ecx
lea ecx, [esi + ebx]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 0x14]
shl ecx, 4
add ecx, dword [ebp - 0x18]
xor edx, ecx
lea ecx, [eax + ebx]
xor edx, ecx
lea ebx, [ebx + 0x61c88647]
sub esi, edx
sub edi, 1
jne 0x415573
mov edi, dword [ebp - 4]
mov dword [edi], esi
mov dword [edi + 4], eax
add edi, 8
mov eax, dword [ebp - 8]
sub eax, 8
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 0x1c]
jb 0x415541
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41e230
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a01be
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov ecx, dword [eax + 8]
cmp edx, ecx
jbe 0x41e2ad
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00409080
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x41e387
inc ecx
push ecx
jmp 0x41e37c
mov eax, dword [eax + 4]
sub ecx, edx
push ecx
add eax, edx
mov byte [ebp - 0x2c], 0
push eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x94], 0x67452301
mov dword [ebp - 0x90], 0xefcdab89
mov dword [ebp - 0x8c], 0x98badcfe
mov dword [ebp - 0x88], 0x10325476
call fcn.0041d3f0
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041de90
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x41e349
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x41e32e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00409a60
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00409830
mov eax, dword [ebp - 0x9c]
cmp eax, 0x10
jb 0x41e367
inc eax
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0xb0]
call fcn.00409a60
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00409080
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x41e387
inc eax
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00409a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret 8
Function at 0x41e3c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov ebx, 4
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov cl, byte [edx + 0xd]
mov byte [eax], cl
mov cl, byte [edx + 0xe]
mov byte [esi + 0xe], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
nop word [eax + eax]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov ch, byte [eax + 2]
mov dh, byte [eax - 1]
mov byte [ebp - 3], cl
mov byte [ebp - 1], dl
mov byte [ebp - 2], ch
test bl, 3
jne 0x41e49b
movzx ecx, cl
mov dl, dh
mov dh, byte [ecx + 0x4bf3f0]
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x4bf3f0]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + 0x4bf3f0]
mov byte [ebp - 1], cl
movzx ecx, dl
mov dl, byte [ebp - 1]
mov cl, byte [ecx + 0x4bf3f0]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
xor dh, byte [ecx + 0x4bf5f0]
mov ch, byte [ebp - 2]
mov cl, byte [eax - 0xd]
inc ebx
xor cl, dh
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, byte [ebp - 3]
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dl
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, ch
mov byte [eax + 6], cl
add eax, 4
cmp ebx, 0x2c
jb 0x41e440
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ecx + 2]
mov esi, 4
nop
mov dl, byte [eax + 1]
lea eax, [eax + 4]
mov bh, byte [eax - 4]
mov dh, dl
mov cl, byte [eax - 6]
xor dh, bh
mov bl, byte [eax - 5]
mov byte [ebp - 2], cl
mov byte [ebp - 3], dl
mov dl, dh
xor dl, cl
xor dl, bl
mov byte [ebp - 1], dl
mov dl, cl
xor dl, bl
mov cl, dl
add dl, dl
shr cl, 7
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, bl
xor cl, byte [ebp - 2]
xor dl, bh
xor cl, byte [ebp - 1]
mov byte [eax - 6], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, byte [ebp - 3]
xor cl, bl
xor dl, byte [ebp - 2]
mov bl, byte [ebp - 1]
xor cl, bl
mov byte [eax - 5], cl
mov cl, dh
shr cl, 7
add dh, dh
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dh
xor cl, bh
xor cl, bl
mov byte [eax - 4], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
xor cl, byte [ebp - 3]
xor cl, bl
mov byte [eax - 3], cl
sub esi, 1
jne 0x41e4e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 0xc], eax
sub edx, edi
mov esi, edi
mov ebx, 4
nop dword [eax]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x41e7a5
sub ebx, 1
jne 0x41e7a0
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov dword [ebp - 8], 9
mov ebx, edi
mov dword [ebp - 4], 4
nop dword [eax + eax]
mov ecx, ebx
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4bf3f0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x41e7e0
inc ebx
sub dword [ebp - 4], 1
jne 0x41e7d0
mov cl, byte [edi + 1]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, edi
mov byte [edi + 0xb], al
call fcn.0041e4d0
mov eax, edi
mov ebx, 4
nop dword [eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x41e865
sub ebx, 1
jne 0x41e860
sub dword [ebp - 8], 1
jne 0x41e7c2
mov esi, edi
lea ebx, [edx + 4]
mov ecx, esi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4bf3f0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x41e890
inc esi
sub ebx, 1
jne 0x41e884
mov cl, byte [edi + 1]
lea esi, [edx + 4]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xb], al
add ecx, 0xa0
mov edx, 4
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
sub edx, 1
jne 0x41e910
sub esi, 1
jne 0x41e906
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e930
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xa0]
nop dword [eax + eax]
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x41e955
sub ebx, 1
jne 0x41e950
mov eax, dword [ebp - 8]
add eax, 0x90
mov byte [ebp - 1], 9
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4bf4f0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x41e9e0
inc edi
sub ebx, 1
jne 0x41e9d0
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x41ea10
sub ebx, 1
jne 0x41ea04
mov ecx, esi
call fcn.0041e580
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x41e974
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4bf4f0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x41eaa0
inc edi
sub ebx, 1
jne 0x41ea92
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x41ead0
sub dword [ebp - 0xc], 1
jne 0x41eac4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret