joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x4fb255
cmp byte [ebx], 0
jne 0x4fb298
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x90d31c]
mov edi, eax
mov dword [esp + 8], edi
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x90d344]
mov dword [esp], edi
mov ebx, eax
call fcn.007238f0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.00723a18
mov dword [ebp - 0x24], eax
sar eax, 6
add eax, 1
mov edi, eax
mov dword [ebp - 0x20], eax
shl edi, 6
lea eax, [edi + 1]
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00723880
mov edx, dword [ebp - 0x24]
mov esi, eax
add edx, 1
mov dword [esp + 8], edx
mov dword [ebp - 0x24], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00723980
mov edx, dword [ebp - 0x24]
lea ecx, [esi + edi]
lea ebx, [esi + edx]
cmp edi, edx
jle 0x4fb31a
mov dword [ebp - 0x24], esi
mov esi, ebx
mov ebx, ecx
lea esi, [esi]
lea esi, [esi]
mov eax, 0xffffffff
add esi, 1
call fcn.004fad60
and eax, 0x7f
mov byte [esi - 1], al
cmp ebx, esi
jne 0x4fb300
mov esi, dword [ebp - 0x24]
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fb320
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fb340
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov byte [0x7708b8], 0
add eax, eax
mov dword [esp], eax
call fcn.00723880
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
je 0x4fb478
call fcn.004fad60
mov edx, eax
mov byte [ebx], al
movzx eax, byte [0x7708a8]
xor al, byte [0x7708c0]
xor al, byte [esi]
xor eax, edx
mov edx, 1
mov byte [ebx + 1], al
mov eax, edx
mov ecx, edx
and eax, 0x1f
and ecx, 0xf
movzx eax, byte [eax + 0x7708c0]
xor al, byte [esi + edx]
xor al, byte [ebx]
xor al, byte [ecx + 0x7708a8]
mov byte [ebx + edx + 1], al
add edx, 1
cmp edi, edx
jne 0x4fb3a0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fb3d0
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fb3f0
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x20]
mov byte [0x7708b8], 0
shl eax, 7
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp + 0xc], 0
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x1c], edx
mov dword [esp], ebx
call fcn.00506550
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x90d31c]
mov edx, dword [ebp - 0x1c]
mov edi, eax
mov dword [esp], edx
call fcn.007238f0
mov dword [esp], ebx
call fcn.007238f0
mov dword [esp], esi
call fcn.007238f0
jmp 0x4fb267
call fcn.004fad60
mov byte [0], 0
ud2
Function at 0x4fb990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x4fb9d6
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.004fb600
mov ecx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [0x90d32c]
mov ebx, eax
test eax, eax
jne 0x4fb9f0
xor ebx, ebx
test edi, edi
je 0x4fba38
mov dword [ebp + 8], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00723840
mov dword [esp], eax
call fcn.00723a18
mov dword [esp + 4], 1
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp], ebx
mov dword [esp + 4], eax
mov esi, eax
call fcn.00506510
mov dword [ebp - 0x2c], eax
test eax, eax
jg 0x4fba48
xor ebx, ebx
test edi, edi
je 0x4fba30
mov dword [esp], edi
call fcn.00723840
mov ebx, eax
mov dword [esp], esi
call fcn.007238f0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fba50
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fba70
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x2c]
mov byte [0x7708b8], 0
lea eax, [eax + eax + 2]
mov dword [esp], eax
call fcn.00723880
movzx edi, byte [esi]
xor ecx, ecx
mov ebx, eax
lea esi, [esi]
nop
mov eax, ecx
mov edx, ecx
and eax, 0x1f
and edx, 0xf
movzx eax, byte [eax + 0x7708c0]
xor al, byte [esi + ecx + 1]
xor eax, edi
xor al, byte [edx + 0x7708a8]
mov byte [ebx + ecx], al
add ecx, 1
cmp dword [ebp - 0x2c], ecx
jne 0x4fbab0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fbae0
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fbb00
mov byte [0x7708b8], 0
jmp 0x4fba30
Function at 0x4fbd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x4fbd65
cmp byte [ebx], 0
jne 0x4fbdc0
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x90d31c]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004fb600
mov dword [esp + 8], edi
mov edx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [0x90d36c]
mov dword [esp], edi
mov ebx, eax
call fcn.007238f0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.00723a18
mov dword [ebp - 0x34], eax
sar eax, 6
add eax, 1
mov edi, eax
mov dword [ebp - 0x30], eax
shl edi, 6
lea eax, [edi + 1]
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00723880
mov edx, dword [ebp - 0x34]
mov esi, eax
add edx, 1
mov dword [esp + 8], edx
mov dword [ebp - 0x34], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00723980
mov edx, dword [ebp - 0x34]
lea ecx, [esi + edi]
lea ebx, [esi + edx]
cmp edi, edx
jle 0x4fbe3a
mov dword [ebp - 0x34], esi
mov esi, ebx
mov ebx, ecx
nop
mov eax, 0xffffffff
add esi, 1
call fcn.004fad60
and eax, 0x7f
mov byte [esi - 1], al
cmp ebx, esi
jne 0x4fbe20
mov esi, dword [ebp - 0x34]
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fbe40
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fbe60
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x2c]
mov byte [0x7708b8], 0
add eax, eax
mov dword [esp], eax
call fcn.00723880
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
je 0x4fbf98
call fcn.004fad60
mov edx, eax
mov byte [ebx], al
movzx eax, byte [0x7708a8]
xor al, byte [0x7708c0]
xor al, byte [esi]
xor eax, edx
mov edx, 1
mov byte [ebx + 1], al
mov eax, edx
mov ecx, edx
and eax, 0x1f
and ecx, 0xf
movzx eax, byte [eax + 0x7708c0]
xor al, byte [esi + edx]
xor al, byte [ebx]
xor al, byte [ecx + 0x7708a8]
mov byte [ebx + edx + 1], al
add edx, 1
cmp edi, edx
jne 0x4fbec0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708c0], 0x374e892e
add eax, 1
cmp eax, 9
jne 0x4fbef0
mov byte [0x7708e0], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x7708a8], 0x374e892e
add eax, 1
cmp eax, 5
jne 0x4fbf10
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x30]
mov byte [0x7708b8], 0
shl eax, 7
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp + 0xc], 0
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x2c], edx
mov dword [esp], ebx
call fcn.00506550
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x90d31c]
mov edx, dword [ebp - 0x2c]
mov edi, eax
mov dword [esp], edx
call fcn.007238f0
mov dword [esp], ebx
call fcn.007238f0
mov dword [esp], esi
call fcn.007238f0
jmp 0x4fbd77
call fcn.004fad60
mov byte [0], 0
ud2
Function at 0x4fd830
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ebx, ebx
je 0x4fd862
add ebx, edx
lea esi, [esi]
nop
mov ecx, eax
xor al, byte [edx]
add edx, 1
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x7ad7c0]
mov eax, ecx
cmp edx, ebx
jne 0x4fd848
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x5048e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
test ebx, ebx
je 0x5049e0
mov dword [esp], ebx
call fcn.00723a18
mov dword [esp + 4], 1
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [ebp - 0x2c], 0
mov edi, eax
movzx eax, byte [ebx]
lea esi, [ebx + 1]
mov edx, edi
test al, al
je 0x504986
xor ecx, ecx
mov byte [ebp - 0x19], cl
jmp 0x504959
cmp al, 0x22
je 0x5049d0
mov byte [edx], al
mov ebx, esi
add edx, 1
movzx eax, byte [ebx]
lea esi, [ebx + 1]
test al, al
je 0x504986
cmp al, 0x2c
je 0x5049b8
cmp al, 0x5c
jne 0x504940
movzx eax, byte [ebx + 1]
test al, al
je 0x504986
cmp al, 0x6e
mov ecx, 0xd
cmove eax, ecx
add ebx, 2
add edx, 1
lea esi, [ebx + 1]
mov byte [edx - 1], al
movzx eax, byte [ebx]
test al, al
jne 0x504959
mov byte [edx], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
call eax
mov dword [ebp + 8], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.007238f0
cmp byte [ebp - 0x19], 0
je 0x5049e8
mov byte [edx], 0x2c
mov ebx, esi
add edx, 1
jmp 0x50494f
xor byte [ebp - 0x19], 1
mov ebx, esi
jmp 0x50494f
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov byte [edx], 0
mov edx, dword [ebp - 0x24]
mov dword [esp], edi
lea ebx, [ecx + 1]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x20]
call eax
mov dword [ebp - 0x2c], ebx
mov ebx, esi
jmp 0x50492a
Function at 0x506180
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test ecx, ecx
je 0x506352
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x506352
test esi, esi
je 0x50632a
test edi, edi
js 0x506310
test edi, edi
jne 0x5061ca
jmp 0x50631f
lea ebx, [esi + 1]
sub edi, 1
je 0x5061fe
mov esi, ebx
movzx eax, byte [esi]
mov dword [esp], eax
call dword [0x90b9d4]
test eax, eax
jne 0x5061c0
mov ebx, esi
lea esi, [esi + edi - 1]
cmp esi, ebx
jb 0x506202
lea esi, [esi]
movzx eax, byte [esi]
mov dword [esp], eax
call dword [0x90b9d4]
test eax, eax
je 0x506202
sub esi, 1
sub edi, 1
cmp esi, ebx
jae 0x5061e8
mov edx, edi
and edx, 3
jne 0x506277
test edi, edi
lea ecx, [edi + 3]
cmovns ecx, edi
sar ecx, 2
lea ecx, [ecx + ecx*2]
cmp dword [ebp + 0xc], ecx
jle 0x506277
test edi, edi
jle 0x50627c
lea eax, [edi - 1]
shr eax, 2
lea esi, [ebx + eax*4 + 4]
mov eax, dword [ebp + 8]
lea esi, [esi]
movzx edx, byte [ebx]
test dl, dl
js 0x506277
movsx edi, byte [edx + 0x7b0860]
cmp edi, 0xffffffff
je 0x506277
movzx edx, byte [ebx + 1]
test dl, dl
js 0x506277
movsx ecx, byte [edx + 0x7b0860]
cmp ecx, 0xffffffff
je 0x506277
mov edx, ecx
shl edi, 2
sar edx, 4
and edx, 3
or edx, edi
mov byte [eax], dl
movzx edx, byte [ebx + 2]
cmp dl, 0x3d
je 0x5062f0
test dl, dl
jns 0x506290
mov edx, 0xffffffff
add esp, 0x1c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
movsx edi, byte [edx + 0x7b0860]
cmp edi, 0xffffffff
je 0x506277
mov edx, edi
shl ecx, 4
sar edx, 2
and edx, 0xf
or edx, ecx
mov byte [eax + 1], dl
movzx edx, byte [ebx + 3]
cmp dl, 0x3d
je 0x506340
test dl, dl
js 0x506277
movzx edx, byte [edx + 0x7b0860]
add ebx, 4
cmp dl, 0xff
je 0x506277
shl edi, 6
add eax, 3
or edx, edi
mov byte [eax - 1], dl
cmp ebx, esi
jne 0x506230
sub eax, dword [ebp + 8]
add esp, 0x1c
mov edx, eax
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
cmp byte [ebx + 3], 0x3d
jne 0x506277
add eax, 1
sub eax, dword [ebp + 8]
mov edx, eax
jmp 0x50627c
mov dword [esp], esi
call fcn.00723a18
mov edi, eax
jmp 0x5061b5
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x506277
add esp, 0x1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
add eax, 2
sub eax, dword [ebp + 8]
add esp, 0x1c
mov edx, eax
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov edx, 0xfffffc7c
jmp 0x50627c
Function at 0x506360
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
test esi, esi
mov ecx, dword [ebp + 0x10]
sete al
test edx, edx
sete dl
or al, dl
jne 0x5064fb
test edi, edi
je 0x5064fb
test ecx, ecx
je 0x5064e8
mov eax, dword [ebp + 0x14]
lea ebx, [eax + 2]
mov eax, 0x55555556
imul ebx
sar ebx, 0x1f
sub edx, ebx
shl edx, 2
cmp esi, edx
jle 0x506502
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jle 0x5064f1
movzx edx, byte [ecx]
mov eax, edx
shl edx, 4
shr al, 2
and edx, 0x30
cmp dword [ebp + 0x14], 1
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
je 0x5064f7
movzx eax, byte [ecx + 1]
mov ebx, eax
shl eax, 2
shr bl, 4
and eax, 0x3c
or edx, ebx
cmp dword [ebp + 0x14], 2
mov ebx, edi
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], dl
je 0x5064a3
mov edi, eax
mov esi, ecx
jmp 0x50645a
movzx edx, byte [esi]
mov eax, edx
shl edx, 4
shr al, 2
and edx, 0x30
cmp dword [ebp + 0x14], 1
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], al
je 0x5064c0
movzx eax, byte [esi + 1]
mov ecx, eax
shl eax, 2
shr cl, 4
and eax, 0x3c
or ecx, edx
cmp dword [ebp + 0x14], 2
mov edi, eax
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + 1], dl
je 0x5064a0
movzx ecx, byte [esi + 2]
add esi, 3
add ebx, 4
xor eax, eax
mov edx, ecx
and ecx, 0x3f
shr dl, 6
or edx, edi
sub dword [ebp + 0x14], 3
movzx edx, dl
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ah, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx - 2], ax
jne 0x506410
mov edi, dword [ebp + 8]
mov edx, ebx
mov eax, ebx
sub edx, edi
mov byte [eax], 0
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 8]
movzx eax, al
mov byte [ebx + 3], 0x3d
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + 2], al
lea eax, [ebx + 4]
mov edx, eax
sub edx, edi
jmp 0x506492
mov edi, dword [ebp + 8]
movzx edx, dl
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, 0x3d3d
mov word [ebx + 2], dx
mov byte [ebx + 1], al
lea eax, [ebx + 4]
mov edx, eax
sub edx, edi
jmp 0x506492
xor edx, edx
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov eax, edi
xor edx, edx
jmp 0x506492
mov ebx, edi
jmp 0x5064c3
mov edx, 0xfffffc7c
jmp 0x506495
mov edx, 0xffffffff
jmp 0x506495
Function at 0x506550
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 1
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
lea edx, [eax + eax]
je 0x506588
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp fcn.00506360
movdqu xmm0, xmmword [str._img_src_data:image_png_base64_]
mov byte [ebx + 0x20], 0
movdqu xmm1, xmmword [0x7b0960]
movups xmmword [ebx], xmm0
movups xmmword [ebx + 0x10], xmm1
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00506360
mov dword [esp], ebx
mov esi, eax
call fcn.00723a18
mov dword [ebx + eax], 0x3e2f22
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x510bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x510db0
test edi, edi
je 0x510db0
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
test ecx, ecx
sete al
test ebx, ebx
sete dl
or al, dl
jne 0x510db0
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x510db0
test edi, edi
lea eax, [edi + 0x3f]
cmovns eax, edi
and eax, 0xffffffc0
lea edx, [eax + 0x48]
add eax, 0x49
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [esp], eax
call fcn.00723968
mov byte [eax], 1
mov esi, eax
mov dword [esp], 0xffffffff
lea ebx, [esi + 0xc]
call fcn.004fd690
mov byte [esi + 1], al
mov dword [esp], 0xffffffff
call fcn.004fd690
mov byte [esi + 2], al
mov dword [esp], 0xffffffff
call fcn.004fd690
mov dword [esi + 4], edi
mov byte [esi + 3], al
mov dword [esp + 8], edi
mov dword [esp + 4], 0xf6854696
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.004fd830
mov dword [esi + 8], eax
mov dword [ebp - 0x34], eax
mov dword [esp + 8], edi
mov ecx, dword [ebp + 8]
add edi, 0xc
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00723980
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
cmp eax, edi
jle 0x510cd0
mov dword [ebp - 0x34], ebx
mov ebx, edi
mov edi, eax
lea esi, [esi]
mov dword [esp], 0xffffffff
call fcn.004fd690
and eax, 0x7f
mov byte [esi + ebx + 0xc], al
add ebx, 1
cmp edi, ebx
jg 0x510cb0
mov ebx, dword [ebp - 0x34]
mov edx, dword [esi + 8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
mov edi, esi
mov dword [ebp - 0x34], esi
lea ecx, [eax + esi]
mov esi, ebx
mov ebx, ecx
lea esi, [esi]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004fd7d0
xor byte [esi], al
add esi, 1
cmp esi, ebx
jne 0x510ce8
mov esi, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], 2
mov ecx, ebx
lea eax, [esi + 2]
movzx ebx, byte [esi + 1]
jle 0x510d98
lea esi, [esi]
xor byte [eax], bl
add eax, 1
cmp eax, ecx
jne 0x510d18
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov ebx, ecx
lea esi, [esi]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004fd7d0
xor byte [edi], al
add edi, 1
cmp edi, ebx
jne 0x510d38
mov dword [esp + 4], 1
mov edi, dword [ebp - 0x2c]
lea eax, [edi + edi + 1]
mov dword [esp], eax
call fcn.00723880
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00506550
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov dword [esp], esi
call fcn.007238f0
mov eax, dword [ebp - 0x30]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x510d4c
jmp 0x510d30
mov dword [ebp - 0x30], 0xfffffc7c
jmp 0x510d8a
Function at 0x510dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test ebx, ebx
je 0x510f38
test eax, eax
je 0x510f38
test esi, esi
sete dl
test edi, edi
sete cl
or dl, cl
jne 0x510f38
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x510f38
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp + 4], eax
mov dword [ebp - 0x2c], eax
mov dword [esp], ebx
call fcn.00506510
mov edx, dword [ebp - 0x2c]
test eax, eax
js 0x510f82
mov ecx, dword [esi + 0xc]
xor ecx, dword [edi + 4]
mov ebx, edx
lea esi, [eax + edx]
mov dword [ebp - 0x1c], ecx
lea edi, [ebp - 0x1c]
test eax, eax
je 0x510e81
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
lea esi, [esi]
nop
mov dword [esp], edi
call fcn.004fd7d0
xor byte [ebx], al
add ebx, 1
cmp ebx, esi
jne 0x510e50
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
movzx ebx, byte [edx + 1]
cmp eax, 2
jle 0x510e81
lea ecx, [edx + 2]
lea esi, [esi]
nop
xor byte [ecx], bl
add ecx, 1
cmp ecx, esi
jne 0x510e78
cmp byte [edx], 1
jne 0x510f68
mov ebx, dword [edx + 4]
cmp eax, ebx
jb 0x510f75
mov ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
cmp eax, 0xc
je 0x510f30
mov dword [ebp - 0x30], edx
lea edi, [edx + 0xc]
lea esi, [edx + eax]
mov dword [ebp - 0x2c], edi
mov ebx, edi
lea edi, [ebp - 0x1c]
lea esi, [esi]
mov dword [esp], edi
call fcn.004fd7d0
xor byte [ebx], al
add ebx, 1
cmp esi, ebx
jne 0x510eb8
mov edx, dword [ebp - 0x30]
mov ebx, dword [edx + 4]
mov dword [ebp - 0x30], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xf6854696
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.004fd830
mov edx, dword [ebp - 0x30]
cmp dword [edx + 8], eax
jne 0x510f3f
mov dword [ebp - 0x30], edx
mov dword [esp], ebx
call fcn.00723968
mov edi, dword [ebp + 0x18]
mov dword [edi], eax
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00723980
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
call fcn.007238f0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + 0xc]
mov dword [ebp - 0x2c], eax
jmp 0x510ecf
mov ebx, 0xfffffc7c
jmp 0x510f1f
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], str.checksum_mismatch_n
mov dword [esp], 6
mov ebx, 0xffffffea
call fcn.004fc8f0
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
call fcn.007238f0
jmp 0x510f1f
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], str.unknown_version_n
jmp 0x510f4a
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], str.invalid_length_n
jmp 0x510f4a
mov dword [esp + 4], str.no_valid_base64_n
jmp 0x510f4a
Function at 0x513400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00513220
test eax, eax
je 0x513560
mov dword [esp], eax
mov edi, eax
call fcn.00723a18
mov dword [esp + 4], 1
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp], edi
mov dword [esp + 4], eax
mov esi, eax
call fcn.00506510
mov edi, eax
test eax, eax
jg 0x513490
test ebx, ebx
je 0x513473
mov dword [esp], ebx
call fcn.00723840
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov dword [eax], ebx
mov dword [ebp + 8], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.007238f0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b60], 0x634e872e
add eax, 1
cmp eax, 9
jne 0x513498
mov byte [0x770b80], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b40], 0x634e872e
add eax, 1
cmp eax, 5
jne 0x5134b8
lea eax, [edi + edi + 2]
mov dword [esp + 4], 1
mov dword [esp], eax
mov byte [0x770b50], 0
call fcn.00723880
xor edx, edx
mov ebx, eax
movzx eax, byte [esi]
mov byte [ebp - 0x19], al
mov eax, edx
mov ecx, edx
and eax, 0x1f
and ecx, 0xf
movzx eax, byte [eax + 0x770b60]
xor al, byte [esi + edx + 1]
xor al, byte [ebp - 0x19]
xor al, byte [ecx + 0x770b40]
mov byte [ebx + edx], al
add edx, 1
cmp edi, edx
jne 0x5134f0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b60], 0x634e872e
add eax, 1
cmp eax, 9
jne 0x513520
mov byte [0x770b80], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b40], 0x634e872e
add eax, 1
cmp eax, 5
jne 0x513540
mov byte [0x770b50], 0
jmp 0x513473
test ebx, ebx
je 0x51356e
mov dword [esp], ebx
call fcn.00723840
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret