joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492510
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0xec], 0xffffffff
push esi
push edi
je 0x4925aa
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea esp, [esp]
test esi, esi
je 0x4925aa
test edi, edi
je 0x4925aa
cmp edi, 0x578
jle 0x49256a
push 0x578
push esi
mov ecx, ebx
call fcn.00492510
sub edi, 0x578
add esi, 0x578
cmp dword [ebx + 0xec], 0xffffffff
jne 0x492530
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov eax, dword [ebx + 0xec]
push 0x10
push 0x6c4de0
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_sendto]
push edi
push esi
push str.send_to__p_nlen__d_
push 0xb9
push str.Client.cpp
push 0x6c5bd8
mov edx, str.CClient::SendToServer
mov ecx, 0x258
call fcn.004ccb50
add esp, 0x18
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x493c30
Capabilities:
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6bef0c], eax
cmp eax, 0xffffffff
jne 0x493c52
or eax, eax
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, 0x1388
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 4]
push ecx
push 0x1005
push 0xffff
push eax
call esi
test eax, eax
jne 0x493ca6
mov eax, dword [0x6bef0c]
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
push eax
call esi
test eax, eax
jne 0x493ca6
push str.update.corpcorp.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x493cae
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [0x6c4de0], ecx
mov dword [0x6c4de4], ecx
mov dword [0x6c4de8], ecx
mov dword [0x6c4dec], ecx
mov ecx, 2
mov word [0x6c4de0], cx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push 0x1f40
mov dword [0x6c4de4], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x6c4de2], ax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644e98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 8], vtable.CXCImage.0
mov dword [esi + 0xc], edi
mov dword [ebp - 4], edi
mov eax, 1
push ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x10], esp
lea eax, [esi + 0x38]
mov dword [ebp - 0x10], esp
push eax
mov dword [esi], vtable.CDataPage.0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.00416b30
mov ecx, dword [0x6c4b78]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [0x6c4e40], esi
cmp ecx, edi
jne 0x493ed0
push 0x50
call fcn.005f0fe0
add esp, 4
cmp eax, edi
je 0x493ec6
push eax
call fcn.00468950
jmp 0x493ec8
xor eax, eax
mov ecx, eax
mov dword [0x6c4b78], ecx
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, dword [0x6c4b78]
mov dword [esi + 0x4c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4998f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
push str.CDataPage::OnDetailDataKillFocus_r_n
lea eax, [esp + 0x18]
mov esi, ecx
mov dword [esp + 0x18], str.DataPage.cpp
mov dword [esp + 0x1c], 0x303
call fcn.0040ec50
add esp, 4
cmp dword [esi + 0x14], 0
je 0x499a8a
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp dword [ebp + 0xc], eax
jne 0x499a8a
mov eax, dword [esi + 0x10]
mov edi, dword [eax + 0x30]
mov ecx, dword [esi + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [ecx + 0x48], edi
jne 0x4999fa
lea edx, [esp + 0x1c]
push edx
call ebx
mov ecx, dword [esi + 0x10]
push edi
call fcn.005513e0
mov edx, dword [esi]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edx + 0x4c]
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [eax + 0xf4]
call edx
push eax
call fcn.00581ba0
mov eax, dword [edi]
mov edx, dword [eax + 0xb4]
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4999fa
push str.m_pDetailData__GetShowItemIndex____m_pEleView__GetSelectItem__
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.DataPage.cpp
mov dword [esp + 0x14], 0x315
call fcn.0040ec50
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
add esp, 4
push 1
call edx
jmp 0x499aab
lea eax, [esp + 0x14]
push eax
call ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x4c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esi]
mov edx, dword [edx + 0xd0]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call edx
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0xb4]
lea edx, [esp + 0x34]
push edx
call eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x499a61
mov dword [esp + 0x10], 0x322
push str.CDataPage::OnDetailDataKillFocus_ptInDetailData_r_n
jmp 0x499a97
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x88]
push 0
call eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push 1
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x80]
push 0
mov ecx, esi
call eax
mov dword [esp + 0x10], 0x32c
push str.CDataPage::OnDetailDataKillFocus_end_r_n
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.DataPage.cpp
call fcn.0040ec50
add esp, 4
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 8
Function at 0x49f670
Capabilities:
Write clipboard data

Disassembly:
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49f675
sub eax, edx
sar eax, 1
push esi
lea eax, [eax + eax + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x49f6a3
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [esi + 1]
pop esi
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49f6b2
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
push edi
push ebx
call fcn.00602090
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49f6d4
sub eax, edx
sar eax, 1
xor edx, edx
push esi
mov word [ebx + eax*2], dx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, 1
pop esi
ret
Function at 0x4b0df0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x646cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.TASKKILL__F__IM_wifiday.exe
mov esi, ecx
call edi
push 0
push str.TASKKILL__F__IM_wifidayrom.exe
call edi
add esi, 0x40
push esi
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x6745b6
lea ecx, [esp + 0x6c]
call fcn.00412330
lea esi, [esp + 0x68]
mov dword [esp + 0xb8], 0
call fcn.004c4b60
push 0xd
push str.config_ad.ini
mov ecx, esi
call fcn.00412ae0
mov eax, dword [esp + 0x6c]
mov edi, 0x10
cmp dword [esp + 0x80], edi
jae 0x4b0e9b
lea eax, [esp + 0x6c]
push eax
push 0x686e68
push str.NowWinodw
push str.System
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x6745b6
lea ecx, [esp + 0x8c]
call fcn.00412330
lea esi, [esp + 0x88]
mov byte [esp + 0xb8], 1
call fcn.004c4b60
push 0x14
push str.wifidayrel.exe__r_10
mov ecx, esi
call fcn.00412ae0
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call fcn.005ff630
xor eax, eax
add esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], 0x44
cmp dword [esp + 0xa0], edi
jae 0x4b0f26
lea eax, [esp + 0x8c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
push 0
call main
int3
Function at 0x4b49d0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x640e20
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
cmp eax, ebx
je 0x4b4b59
push 0x28
lea ecx, [esp + 0xa4]
push ecx
push eax
mov dword [esp + 0xac], 0x28
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
mov edx, dword [esp + 0xac]
and edx, 0xfff00000
cmp edx, 0x1f400000
jbe 0x4b4b59
mov eax, dword [0x6c4f38]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4b4a67
push eax
call edi
mov dword [esp + 0x80], ebx
push 8
mov dword [esp + 0xdc], ebx
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x4b4b91
mov dword [esp + 0x80], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0x80]
mov dword [ecx], eax
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov esi, eax
mov dword [esp + 0xd8], 1
call fcn.004c4b60
push 0xc
push str.wifinono.exe
mov ecx, esi
call fcn.00412c10
push 0x44
lea edx, [esp + 0x38]
push ebx
push edx
call fcn.005ff630
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x98], 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], 0x44
jae 0x4b4b22
lea eax, [esp + 0x84]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4b4b7d
lea ecx, [esp + 0x80]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00412410
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
push ebx
call main
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
call fcn.005f41f0
push 0x6a361c
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.006009e0
int3
Function at 0x4b6d40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x649ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68c], eax
xor eax, eax
push str.0.0.0.0
lea ecx, [ebp - 0x684]
xor ebx, ebx
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], eax
call fcn.00412330
cmp dword [ebp - 0x66c], 0x10
mov eax, dword [ebp - 0x680]
jae 0x4b6db7
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
cmp dword [ebp - 0x66c], 0x10
mov dword [ebp - 0x660], eax
jb 0x4b6de3
mov ecx, dword [ebp - 0x680]
push ecx
call fcn.005f0cb0
add esp, 4
mov dword [ebp - 0x66c], 0xf
mov dword [ebp - 0x670], ebx
mov byte [ebp - 0x680], bl
lea ecx, [ebp - 0x684]
mov dword [ebp - 4], ebx
call fcn.0040ed70
mov edx, dword [ebp - 0x684]
push edx
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x684], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0040ed70
mov eax, 2
push 0x1c
mov word [ebp - 0x664], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x63f
lea ecx, [ebp - 0x653]
push ebx
push ecx
mov word [ebp - 0x662], ax
xor edi, edi
mov byte [ebp - 0x654], bl
call fcn.005ff630
mov edx, dword [0x6c4ee4]
mov eax, dword [edx]
add esp, 0xc
mov dword [ebp - 0x688], 0x10
cmp eax, 0xffffffff
je 0x4b6eb3
lea ecx, [ebp - 0x654]
test ecx, ecx
je 0x4b6eb3
lea edx, [ebp - 0x664]
test edx, edx
je 0x4b6eb3
lea ecx, [ebp - 0x688]
push ecx
push edx
push ebx
push 0x640
lea ecx, [ebp - 0x654]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, ebx
jl 0x4b6eb3
mov edi, eax
lea edx, [ebp - 0x654]
push edx
push str.recv__0.0.0.0_____s
push 0x1d1
push str.MonitorPacketData.cpp
push 0x6c5bd8
mov edx, str.CMonitorPacketData::HandleSocket
mov ecx, 0x258
call fcn.004ccb50
add esp, 0x14
mov eax, 0x10
xor ecx, ecx
jmp 0x4b6ef0
mov edx, dword [ebp + ecx - 0x654]
cmp edx, dword [ecx + str.wfdbrodcast]
jne 0x4b6f33
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4b6ef0
push edi
lea ecx, [ebp - 0x654]
call fcn.004b4f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x68c]
lea eax, [ebp - 0x654]
push eax
push ecx
mov ecx, edi
call fcn.004b6340
jmp 0x4b6f16
Function at 0x4c96f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63c8f2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x691b14
mov dword [edi + 0x10], 0x691b1c
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.004caca0
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.004cb490
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x6c5c7c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov ecx, dword [ebp + 0xc]
push 1
mov byte [ebp - 4], 2
call fcn.004cad80
test eax, eax
jne 0x4c97e9
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x4c97e2
or eax, 4
push ebx
push eax
call fcn.00471750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cb490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63409b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005653f0
push 0x18
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCinclude_streambuf
mov dword [ebp - 4], 0
call fcn.00564690
push eax
push 4
call fcn.005645c0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4cb51d
call fcn.00564960
mov dword [edi], eax
call fcn.00564770
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00564140
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4cb513
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00564180
jmp 0x4cb51f
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3df0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
movzx ecx, byte [eax]
push esi
movzx esi, byte [eax + 1]
shl ecx, 8
xor ecx, esi
movzx esi, byte [eax + 2]
push edi
shl ecx, 8
xor ecx, esi
movzx esi, byte [eax + 3]
shl ecx, 8
xor ecx, esi
mov dword [edx], ecx
movzx esi, byte [eax + 4]
movzx edi, byte [eax + 5]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
mov dword [edx + 4], esi
movzx esi, byte [eax + 8]
movzx edi, byte [eax + 9]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xa]
lea ecx, [edx + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
xor esi, edi
mov dword [edx + 8], esi
movzx esi, byte [eax + 0xc]
movzx edi, byte [eax + 0xd]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, edi
shl esi, 8
xor esi, eax
mov dword [edx + 0xc], esi
mov eax, esi
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + str.ccccwwww]
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff0000
xor eax, 0x1000000
and eax, 0xff000000
xor eax, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + str.ccccwwww]
xor eax, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff00
xor eax, edi
xor eax, dword [edx]
mov edi, dword [ecx]
xor edi, eax
mov dword [edx + 0x10], eax
mov eax, dword [edx + 8]
xor eax, edi
xor esi, eax
mov dword [edx + 0x1c], esi
mov dword [edx + 0x14], edi
mov dword [edx + 0x18], eax
mov esi, 0x6706c0
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + str.ccccwwww]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + str.ccccwwww]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
shr edi, 0x18
movzx edi, byte [edi*4 + str.ccccwwww]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x6706e4
jne 0x4d3ef4
pop edi
mov eax, 0xa
pop esi
ret
Function at 0x4d3f90
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edx, ebx
call fcn.004d3df0
lea esi, [eax*4]
xor edi, edi
mov dword [ebp - 4], eax
test esi, esi
jle 0x4d4002
lea edx, [ebx + esi*4 + 8]
lea ecx, [ebx + 8]
jmp 0x4d3fc0
mov ebx, dword [edx - 8]
mov eax, dword [ecx - 8]
mov dword [ecx - 8], ebx
mov ebx, dword [edx - 4]
mov dword [edx - 8], eax
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebx
mov ebx, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebx
mov ebx, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebx
mov dword [edx + 4], eax
add edi, 4
sub esi, 4
add ecx, 0x10
sub edx, 0x10
cmp edi, esi
jl 0x4d3fc0
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
cmp eax, 1
jle 0x4d41be
lea ecx, [ebx + 2]
lea esi, [eax - 1]
mov edx, dword [ecx + 0xe]
movzx ebx, byte [ecx + 0xf]
mov ebx, dword [ebx*4 + str.ccccwwww]
add ecx, 0x10
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x6723a0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x672ba0]
movzx ebx, byte [ecx]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x6727a0]
movzx ebx, byte [ecx + 3]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x672fa0]
mov edx, dword [ecx + 2]
mov dword [ecx - 2], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x6723a0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x672ba0]
movzx ebx, byte [ecx + 4]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x6727a0]
movzx ebx, byte [ecx + 7]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x672fa0]
mov edx, dword [ecx + 6]
mov dword [ecx + 2], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x6723a0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x672ba0]
movzx ebx, byte [ecx + 8]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x6727a0]
movzx ebx, byte [ecx + 0xb]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x672fa0]
mov edx, dword [ecx + 0xa]
mov dword [ecx + 6], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x6723a0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x672ba0]
movzx ebx, byte [ecx + 0xc]
mov ebx, dword [ebx*4 + str.ccccwwww]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x6727a0]
and edx, 0xff
xor edi, dword [edx*4 + 0x672fa0]
dec esi
mov dword [ecx + 0xa], edi
jne 0x4d4011
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret