joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433db0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5122f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5601cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 0x10]
call dword [0x514590]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [edi], vtable.UGCall.0
call dword [0x514568]
lea ecx, [edi + 0x14]
call dword [0x514568]
lea ecx, [edi + 0x18]
call dword [0x514568]
push 1
push 0x51543c
mov byte [ebp - 4], 3
call dword [0x51458c]
add esp, 8
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x20]
call dword [0x514568]
lea ecx, [edi + 0x24]
call dword [0x514568]
lea ecx, [edi + 0x28]
call dword [0x514568]
lea ecx, [edi + 0x2c]
call dword [0x514568]
lea ecx, [edi + 0x30]
call dword [0x514568]
lea ecx, [edi + 0x38]
mov byte [edi + 0x34], 0
call dword [0x514ff4]
lea ecx, [edi + 0x40]
call dword [0x514568]
lea ecx, [edi + 0x44]
call dword [0x514ff4]
lea ecx, [edi + 0x48]
call dword [0x514ff4]
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
push 0x437970
mov byte [ebp - 4], 0xd
mov dword [0x564e00], edi
call fcn.00509a72
test eax, eax
je 0x433ebd
cmp eax, 0xffffffff
je 0x433ebd
push ecx
mov esi, esp
push 0x17
push 0x519614
call dword [0x51458c]
add esp, 8
mov dword [esi], eax
mov ecx, dword [edi + 8]
call fcn.00407060
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x435e80
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51286b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5601cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x51543c
lea ecx, [edi + 0x2c]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x20]
call dword [0x514654]
push 0x515375
lea ecx, [edi + 0x14]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x18]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x1c]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x24]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x28]
call dword [0x514654]
push 0x51543c
lea ecx, [edi + 0x30]
call dword [0x514654]
mov ebx, dword [0x51458c]
push ecx
mov esi, esp
mov byte [edi + 0x34], 0
push 0xe
push 0x51967c
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, dword [edi + 8]
call fcn.00407060
mov ecx, dword [edi + 8]
push 0x516f24
add ecx, 0x128
call dword [0x514658]
test al, al
je 0x435fe2
push ecx
mov ecx, dword [edi + 8]
mov eax, esp
mov dword [ebp - 0x10], esp
push 0xffffffffffffffff
push eax
call fcn.00405cf0
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0xa
push 0xffffffffffffffff
push eax
mov dword [ebp - 4], 0
call dword [0x514588]
add esp, 8
mov byte [ebp - 4], 1
mov esi, esp
push 5
push str.PHONE
call ebx
mov dword [esi], eax
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0xc]
call fcn.00424de0
push ecx
mov dword [ebp - 0x18], esp
mov esi, esp
push 6
push 0x516ce0
call ebx
mov dword [esi], eax
add esp, 4
mov dword [ebp - 4], 2
mov esi, esp
push 0xb
push str.PhoneOnline
call ebx
mov dword [esi], eax
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 8]
call fcn.00407390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne case.default.0x439fb1
mov eax, dword [ebp + 0x10]
cmp eax, 8
ja case.default.0x439fb1
jmp dword [eax*4 + 0x43a040]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, word [eax]
push eax
call fcn.00420610
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004207b0
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0043cfd0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.00420900
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.004210b0
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0041cad0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, dword [ecx]
push dword [eax]
call dword [edx + 0xa4]
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, dword [ecx]
push dword [eax]
call dword [edx + 0x78]
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00422a30

Function at 0x446150
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x4861b0
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x5601cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x35
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x60]
push 0
push eax
push esi
call fcn.00486bc0
mov ax, word [ebp - 0x60]
add esp, 0x10
cmp ax, word [0x526518]
je 0x4861fd
cmp ax, word [0x52651c]
je 0x486206
xor eax, eax
jmp 0x48620e
cmp ax, word [0x52651c]
jne 0x48620b
lea eax, [ebp - 0x58]
jmp 0x48620e
lea eax, [ebp - 0x5c]
push eax
push edi
push esi
call fcn.00484de0
add esp, 0xc
test eax, eax
je 0x486268
cmp dword [ebp + 0x14], 0
je 0x486228
push 0x35
push edi
jmp 0x486253
movzx eax, word [0x526518]
cmp esi, eax
jne 0x48623a
push str.1.1.1.1
jmp 0x48623f
push str.1::1
call fcn.0043dec0
add esp, 4
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x68], edx
push 0x35
push eax
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.00486bc0
add esp, 0x10
test eax, eax
jne 0x4863a9
lea eax, [ebp - 0x64]
push eax
movzx eax, word [0x52652c]
push 0
push eax
push esi
call fcn.00485630
add esp, 0x10
test eax, eax
jne 0x4863a9
mov cx, word [ebp - 0x60]
mov dx, word [0x52651c]
cmp cx, word [0x526518]
je 0x4862a0
cmp cx, dx
jne 0x4862b0
cmp cx, dx
mov eax, 0x10
mov esi, 0x1c
cmove eax, esi
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x64]
call fcn.00485160
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4862e4
push dword [ebp - 0x64]
call fcn.00485110
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c187
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x64]
mov dword [ebp - 0x70], 0x1c
call fcn.004851c0
add esp, 0xc
mov esi, eax
push dword [ebp - 0x64]
call fcn.00485110
test esi, esi
jne 0x4862ce
push 0x40
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.0050a9d8
push edi
call fcn.004868e0
push edi
mov esi, eax
call fcn.00486920
mov edi, eax
lea edx, [ebp - 0x44]
add esp, 0x18
sub edi, 4
jb 0x486344
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x486349
add esi, 4
add edx, 4
sub edi, 4
jae 0x486333
cmp edi, 0xfffffffc
je 0x4863a4
mov al, byte [esi]
cmp al, byte [edx]
jne 0x486376
cmp edi, 0xfffffffd
je 0x4863a4
mov al, byte [esi + 1]
cmp al, byte [edx + 1]
jne 0x486376
cmp edi, 0xfffffffe
je 0x4863a4
mov al, byte [esi + 2]
cmp al, byte [edx + 2]
jne 0x486376
cmp edi, 0xffffffff
je 0x4863a4
mov al, byte [esi + 3]
cmp al, byte [edx + 3]
je 0x4863a4
test ebx, ebx
je 0x486391
movups xmm0, xmmword [ebp - 0x60]
mov eax, dword [ebp - 0x48]
movups xmmword [ebx], xmm0
movq xmm0, qword [ebp - 0x50]
movq qword [ebx + 0x10], xmm0
mov dword [ebx + 0x18], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c187
mov esp, ebp
pop ebp
ret
mov eax, 0x11176
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c187
mov esp, ebp
pop ebp
ret
Function at 0x49d360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
or eax, 0xffffffff
push esi
mov esi, dword [ebp + 0xc]
test bl, 3
je 0x49d390
test esi, esi
je 0x49d390
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x529988]
test bl, 3
jne 0x49d373
cmp esi, 4
jb 0x49d3e1
mov edx, esi
shr edx, 2
nop word [eax + eax]
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
sub edx, 1
jne 0x49d3a0
test esi, esi
je 0x49d3ff
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x529988]
sub esi, 1
jne 0x49d3e5
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x49d430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
not eax
test bl, 3
je 0x49d465
test esi, esi
je 0x49d465
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x529988]
test bl, 3
jne 0x49d448
cmp esi, 4
jb 0x49d4b1
mov edx, esi
shr edx, 2
nop
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x529988]
sub edx, 1
jne 0x49d470
test esi, esi
je 0x49d4cf
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x529988]
sub esi, 1
jne 0x49d4b5
not eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4be6b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x5601cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xb8], esi
cmp edi, 0x40
jbe 0x4be715
lea eax, [ebp - 0xb4]
push eax
call fcn.004d6330
push edi
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.004d6370
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004d6190
lea eax, [ebp - 0x18]
add esp, 0x18
mov dword [ebp - 0xb8], eax
mov edi, 0x14
push 0x40
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0050a9d8
push 0x40
lea esi, [ebx + 0x5c]
push 0
push esi
call fcn.0050a9d8
push edi
push dword [ebp - 0xb8]
lea eax, [ebp - 0x58]
push eax
call fcn.0050a9cc
push edi
push dword [ebp - 0xb8]
push esi
call fcn.0050a9cc
add esp, 0x30
xor eax, eax
xor byte [ebp + eax - 0x58], 0x36
xor byte [esi + eax], 0x5c
inc eax
cmp eax, 0x40
jb 0x4be751
push ebx
call fcn.004d6330
push 0x40
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.004d6370
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043c187
mov esp, ebp
pop ebp
ret
Function at 0x4d1820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5601cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x118], eax
push edi
movzx eax, word [ebx + 2]
lea esi, [ebx + 4]
push eax
call dword [0x514c78]
movzx eax, ax
lea edi, [esi + eax*4]
movzx eax, word [ebx]
push eax
call dword [0x514c78]
mov ecx, 0xbede
cmp ax, cx
jne 0x4d193d
cmp esi, edi
jae 0x4d1915
mov al, byte [esi]
movzx ebx, al
mov cl, al
and ebx, 0xf
shr cl, 4
inc ebx
mov byte [ebp - 0x109], cl
inc esi
lea eax, [ebx + 1]
mov dword [ebp - 0x110], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x114], eax
cmp eax, edi
ja 0x4d1a39
cmp cl, 0xf
je 0x4d1915
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x118]
push dword [eax + 4]
call fcn.004df620
add esp, 0xc
test eax, eax
jne 0x4d1a23
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
test eax, eax
je 0x4d18fc
test ecx, ecx
jle 0x4d18fc
movzx edx, byte [ebp - 0x109]
nop dword [eax]
cmp dword [eax], edx
je 0x4d1928
dec ecx
add eax, 4
test ecx, ecx
jg 0x4d18f0
mov esi, dword [ebp - 0x114]
cmp esi, edi
jae 0x4d1915
mov al, byte [esi]
test al, al
jne 0x4d1878
inc esi
cmp esi, edi
jb 0x4d1906
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c187
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x107]
nop
mov al, byte [ecx]
inc ecx
xor byte [esi], al
inc esi
sub ebx, 1
jne 0x4d1930
jmp 0x4d1902
movzx eax, word [ebx]
push eax
call dword [0x514c78]
mov ecx, 0x1fff
and ax, cx
mov ecx, 0x100
cmp ax, cx
jne 0x4d1a39
lea eax, [ebx + 5]
cmp eax, edi
jae 0x4d1915
movzx ebx, byte [esi + 1]
mov al, byte [esi]
add esi, 2
mov byte [ebp - 0x109], al
lea eax, [ebx + 2]
mov dword [ebp - 0x114], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x110], eax
cmp eax, edi
ja 0x4d1a39
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x118]
push dword [eax + 4]
call fcn.004df620
add esp, 0xc
test eax, eax
jne 0x4d1a23
test ebx, ebx
je 0x4d19dc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
test eax, eax
je 0x4d19dc
test ecx, ecx
jle 0x4d19dc
movzx edx, byte [ebp - 0x109]
nop dword [eax]
cmp dword [eax], edx
je 0x4d1a0e
dec ecx
add eax, 4
test ecx, ecx
jg 0x4d19d0
mov esi, dword [ebp - 0x110]
cmp esi, edi
jae 0x4d19f0
cmp byte [esi], 0
jne 0x4d19f0
inc esi
cmp esi, edi
jb 0x4d19e6
lea eax, [esi + 1]
cmp eax, edi
jb 0x4d1964
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c187
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x106]
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
inc esi
sub ebx, 1
jne 0x4d1a14
jmp 0x4d19e2
pop edi
pop esi
mov eax, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c187
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c187
mov esp, ebp
pop ebp
ret
Function at 0x4d4db0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 8], eax
test esi, esi
je 0x4d4efc
test eax, eax
je 0x4d4efc
cmp dword [ebp + 0x14], ebx
je 0x4d4efc
push edi
mov edi, dword [ebp + 0xc]
mov eax, 0x55555556
lea ecx, [edi*4]
imul ecx
mov ecx, dword [ebp + 0x14]
mov eax, edx
shr eax, 0x1f
add eax, 3
add eax, edx
cmp dword [ecx], eax
jge 0x4d4e0b
pop edi
pop esi
mov eax, 0x11183
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
test edi, edi
jle 0x4d4eeb
movzx ecx, byte [esi]
lea edi, [edx + 4]
mov eax, ecx
mov dword [ebp - 8], edi
shr eax, 2
lea edi, [edx + 1]
inc ebx
and ecx, 3
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 0xb], al
cmp ebx, dword [ebp + 0xc]
je 0x4d4ed5
movzx eax, byte [esi + 1]
inc ebx
mov dword [ebp - 4], eax
and dword [ebp - 4], 0xf
shr eax, 4
shl ecx, 4
or eax, ecx
mov cl, byte [ebp + 0xb]
mov ah, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp ebx, dword [ebp + 0xc]
je 0x4d4eac
mov al, byte [esi + 2]
inc ebx
mov byte [edx], cl
add esi, 3
movzx edx, al
mov byte [edi], ah
mov ecx, edx
mov eax, dword [ebp - 4]
and edx, 0x3f
shl eax, 2
shr ecx, 6
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp - 8]
mov byte [edi + 2], al
cmp ebx, dword [ebp + 0xc]
jl 0x4d4e16
mov eax, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edx], cl
mov edx, dword [ebp - 8]
sub edx, dword [ebp + 0x10]
mov byte [edi], ah
mov eax, dword [ebp - 4]
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
mov eax, dword [ebp + 0x14]
mov byte [edi + 2], 0x3d
pop edi
pop esi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
shl ecx, 4
mov byte [edx], al
mov edx, dword [ebp - 8]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
mov word [edi + 1], 0x3d3d
mov eax, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x11174
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6330
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x4dec70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov edx, eax
push ebx
mov ebx, dword [ebp + 8]
and edx, 0x1f
push esi
push edi
mov esi, eax
mov dword [ebp - 4], edx
mov edi, dword [ebx]
mov ecx, edi
sar esi, 5
shr ecx, 5
mov dword [ebp - 8], esi
mov dword [ebp + 0xc], ecx
cmp eax, edi
jl 0x4decb5
shr edi, 3
push edi
push 0
push dword [ebx + 4]
call fcn.0050a9d8
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ecx
sub edi, esi
mov dword [ebp - 0x14], edi
test edx, edx
jne 0x4dece4
test edi, edi
jle 0x4ded45
shl esi, 2
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea esi, [esi + 4]
mov eax, dword [esi + ecx - 4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, edi
jl 0x4decd0
jmp 0x4ded42
lea eax, [edi - 1]
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x4ded32
mov ecx, 0x20
lea eax, [esi*4]
sub ecx, edx
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebx + 4]
mov edx, dword [eax + esi + 4]
mov eax, dword [eax + esi]
shl edx, cl
mov ecx, dword [ebp - 4]
shr eax, cl
mov ecx, dword [ebp - 0x10]
xor edx, eax
mov eax, dword [ebp + 8]
mov dword [esi + edi*4], edx
add eax, 4
inc edi
mov dword [ebp + 8], eax
cmp edi, dword [ebp - 0xc]
jl 0x4ded04
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov eax, dword [edx + ecx*4 - 4]
mov ecx, dword [ebp - 4]
shr eax, cl
mov dword [edx + edi*4 - 4], eax
mov ecx, dword [ebp + 0xc]
mov esi, edi
cmp edi, ecx
jge 0x4dedb0
cmp dword [ebp - 8], 4
jb 0x4dedb0
lea eax, [ebx + 4]
mov dword [ebp + 8], eax
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea edx, [eax - 4]
lea edx, [edx + ecx*4]
lea eax, [eax + edi*4]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 8]
cmp eax, dword [ebp + 8]
ja 0x4ded78
lea eax, [ebx + 4]
cmp dword [ebp - 0x14], eax
jae 0x4dedb0
and edx, 0x80000003
jns 0x4ded85
dec edx
or edx, 0xfffffffc
inc edx
sub ecx, edx
add esi, 4
cmp esi, ecx
jl 0x4ded87
sub ecx, edi
lea eax, [ecx + 3]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, dword [ebp - 0x10]
sar ecx, 2
shl ecx, 4
shr ecx, 2
xor eax, eax
lea edi, [edx + edi*4]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jge 0x4dedc3
mov eax, dword [ebx + 4]
mov dword [eax + esi*4], 0
inc esi
cmp esi, ecx
jl 0x4dedb4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dedf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
add eax, edx
xor bl, bl
push edi
mov edi, eax
xor esi, esi
sub edi, edx
cmp edx, eax
cmova edi, ecx
test edi, edi
je 0x4deeb0
mov eax, dword [ebp + 8]
cmp edi, 0x20
jb 0x4dee93
mov ecx, edi
xorps xmm3, xmm3
and ecx, 0xffffffe0
xorps xmm2, xmm2
nop dword [eax + eax]
movups xmm0, xmmword [edx]
add esi, 0x20
movups xmm1, xmmword [eax]
pxor xmm1, xmm0
movups xmm0, xmmword [edx + 0x10]
add edx, 0x20
por xmm3, xmm1
movups xmm1, xmmword [eax + 0x10]
add eax, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, ecx
jb 0x4dee30
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ebx, xmm2
cmp esi, edi
jae 0x4deeb0
sub edx, eax
nop dword [eax]
mov cl, byte [edx + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
inc esi
or bl, cl
cmp esi, edi
jb 0x4deea0
xor eax, eax
test bl, bl
pop edi
pop esi
setne al
pop ebx
pop ebp
ret

Function at 0x4df090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
mov ebx, eax
and ecx, 0x1f
sar ebx, 5
mov dword [ebp - 0x10], ebx
cmp eax, 0x7f
jle 0x4df0cf
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
jne 0x4df0f7
mov edi, 4
xor ecx, ecx
sub edi, ebx
test edi, edi
jle 0x4df150
lea edx, [esi + ebx*4]
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jl 0x4df0e8
jmp 0x4df150
mov eax, 3
xor edi, edi
sub eax, ebx
mov dword [ebp - 8], eax
test eax, eax
jle 0x4df145
mov eax, 0x20
sub eax, ecx
mov dword [ebp - 0xc], eax
lea eax, [esi + ebx*4]
mov dword [ebp + 0xc], eax
mov ebx, ecx
nop dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax]
shl edx, cl
mov ecx, ebx
shr eax, cl
xor edx, eax
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4], edx
add eax, 4
inc edi
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 8]
jl 0x4df120
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi + 0xc]
shr eax, cl
mov ecx, dword [ebp - 8]
mov dword [esi + ecx*4], eax
mov edx, 4
sub edx, ebx
cmp edx, 4
jge 0x4df165
mov ecx, ebx
lea edi, [esi + edx*4]
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fcb70
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
movzx eax, byte [eax + str.cw]
mov byte [edx], al
movzx eax, byte [edx + 4]
movzx eax, byte [eax + str.cw]
mov byte [edx + 4], al
movzx eax, byte [edx + 8]
movzx eax, byte [eax + str.cw]
mov byte [edx + 8], al
movzx eax, byte [edx + 0xc]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xc], al
movzx eax, byte [edx + 1]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 5]
movzx eax, byte [eax + str.cw]
mov byte [edx + 1], al
movzx eax, byte [edx + 9]
movzx eax, byte [eax + str.cw]
mov byte [edx + 5], al
movzx eax, byte [edx + 0xd]
mov byte [edx + 0xd], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 9], al
movzx eax, byte [edx + 0xa]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 2]
mov byte [edx + 2], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xa], al
movzx eax, byte [edx + 0xe]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 6]
mov byte [edx + 6], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xe], al
movzx eax, byte [edx + 0xf]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 0xb]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xf], al
movzx eax, byte [edx + 7]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xb], al
movzx eax, byte [edx + 3]
mov byte [edx + 3], cl
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + str.cw]
mov byte [edx + 7], al
mov eax, dword [ecx]
xor dword [edx], eax
mov eax, dword [ecx + 4]
xor dword [edx + 4], eax
mov eax, dword [ecx + 8]
xor dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
xor dword [edx + 0xc], eax
pop ebp
ret