joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c80
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8268
call fcn.004d0180
mov eax, dword [0x76c500]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x4f6668
lea eax, [ebp - 0x8208]
push eax
call fcn.004cfda0
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x8208]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402cd4
or eax, 0xffffffff
jmp 0x402e70
mov dword [ebp - 0x821c], 0x100
lea eax, [ebp - 0x821c]
push eax
lea ecx, [ebp - 0x8108]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402d12
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x402e70
lea ecx, [ebp - 0x8108]
push ecx
push 0x4f6694
lea edx, [ebp - 0x8208]
push edx
call fcn.004d0ba5
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x8208]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402d56
or eax, 0xffffffff
jmp 0x402e70
mov dword [ebp - 0x821c], 0x100
mov byte [ebp - 0x8108], 0
lea edx, [ebp - 0x821c]
push edx
lea eax, [ebp - 0x8108]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402d9b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x402e70
movsx eax, byte [ebp - 0x8108]
test eax, eax
jne 0x402dae
or eax, 0xffffffff
jmp 0x402e70
push 0x44
push 0
lea ecx, [ebp - 0x8268]
push ecx
call fcn.004d0840
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x8218]
push edx
call fcn.004d0840
add esp, 0xc
mov dword [ebp - 0x8268], 0x44
mov dword [ebp - 0x823c], 1
mov eax, 1
mov word [ebp - 0x8238], ax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x8108]
push edx
push 0x4f66bc
lea eax, [ebp - 0x8008]
push eax
call fcn.004d0ba5
add esp, 0x10
lea ecx, [ebp - 0x8218]
push ecx
lea edx, [ebp - 0x8268]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x8008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402e45
or eax, 0xffffffff
jmp 0x402e70
mov ecx, dword [ebp - 0x8214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x8218]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x8218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d0170
mov esp, ebp
pop ebp
ret
Function at 0x416080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4160b0
jmp 0x4160d3
push 0x50eea4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040cab0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4160d1
mov dword [ebp - 0x18], 0xffffffff
jmp 0x4160f4
push 0x50eea8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004d0f8b
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4160f4
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x4161c9
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x416113
jmp 0x41612e
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040d440
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x416147
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.004d2e5e
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x14]
jae 0x416193
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x41615d
jmp 0x416177
mov eax, dword [ebp - 8]
push eax
call fcn.0040d870
add esp, 4
test eax, eax
jne 0x416175
or eax, 0xffffffff
jmp 0x416208
jmp 0x41618c
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004d3494
add esp, 4
test eax, eax
jne 0x41618c
or eax, 0xffffffff
jmp 0x416208
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 4], 0
jbe 0x4161b0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004c1c90
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x18], 0
jne 0x4161c9
cmp dword [ebp - 4], 0
ja 0x4160fe
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4161d7
jmp 0x4161eb
cmp dword [ebp - 8], 0
je 0x4161e9
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040d790
add esp, 4
jmp 0x4161fd
cmp dword [ebp - 0x14], 0
je 0x4161fd
mov edx, dword [ebp - 0x14]
push edx
call fcn.004d0e5b
add esp, 4
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x44aab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cff30
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx ax, byte [edx]
mov word [ebp - 0x10], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
movzx edx, word [ebp - 0x10]
mov ecx, dword [ebp - 4]
shl edx, cl
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
and eax, 0x7fff
mov ecx, dword [ebp - 8]
sar ecx, 0xf
or eax, ecx
mov edx, dword [ebp + 0xc]
xor eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jl 0x44aad5
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0xc]
xor ecx, 0xce4b
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4745b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb8
mov eax, dword [0x76c500]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfb8], eax
cmp dword [ebp - 0xfb8], 0
je 0x4745d7
jmp 0x4745fc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push 0xfa0
push 1
lea eax, [ebp - 0xfb0]
push eax
call fcn.0040d440
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x47461f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0xfa0
push 1
lea eax, [ebp - 0xfb0]
push eax
call fcn.004d2e5e
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47462a
or eax, 0xffffffff
jmp 0x474670
lea ecx, [ebp - 0xfb4]
push ecx
lea edx, [ebp - 0xfaa]
push edx
call fcn.004103c0
add esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xfb4]
mov dword [eax + 8], ecx
lea edx, [ebp - 0xfb4]
push edx
lea eax, [ebp - 0xfa8]
push eax
call fcn.004103c0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xfb4]
mov dword [ecx + 0xc], edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0170
mov esp, ebp
pop ebp
ret
Function at 0x4749e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb8
mov eax, dword [0x76c500]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfb8], eax
cmp dword [ebp - 0xfb8], 0
je 0x474a07
jmp 0x474a2c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push 0xfa0
push 1
lea eax, [ebp - 0xfb0]
push eax
call fcn.0040d440
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x474a4f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0xfa0
push 1
lea eax, [ebp - 0xfb0]
push eax
call fcn.004d2e5e
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x6c
jge 0x474a5c
mov eax, 0xffffff9a
jmp 0x474aa2
lea ecx, [ebp - 0xfb4]
push ecx
lea edx, [ebp - 0xfa6]
push edx
call fcn.004103c0
add esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xfb4]
mov dword [eax + 8], ecx
lea edx, [ebp - 0xfb4]
push edx
lea eax, [ebp - 0xfa4]
push eax
call fcn.004103c0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xfb4]
mov dword [ecx + 0xc], edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0170
mov esp, ebp
pop ebp
ret

Function at 0x474ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x76c500]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x474ad7
jmp 0x474b0c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x100
push 1
lea eax, [ebp - 0x118]
push eax
call fcn.0040d440
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x100
je 0x474b0a
mov eax, 0xffffff9a
jmp 0x474b79
jmp 0x474b3f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push 0x100
push 1
lea eax, [ebp - 0x118]
push eax
call fcn.004d2e5e
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x100
je 0x474b3f
mov eax, 0xffffff9a
jmp 0x474b79
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004103e0
add esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004103e0
add esp, 8
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004d0170
mov esp, ebp
pop ebp
ret
Function at 0x478e40
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [ebp - 0xc]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x49c3e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x49c405
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
je 0x49c405
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4b03f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 1
call fcn.0049c4c0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b041f
xor eax, eax
jmp 0x4b0555
mov edx, dword [ebp - 8]
mov dword [edx + 0x288], 0xf4240
mov eax, dword [ebp - 8]
mov dword [eax + 0x28c], 0xf4240
push 0x40
push 0x4d4fc0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049c350
add esp, 0xc
push 0
push eax
call fcn.004d5080
add esp, 8
test eax, eax
je 0x4b0463
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049c7d0
add esp, 0x10
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049c450
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00497530
add esp, 8
test eax, eax
jne 0x4b04ae
mov dword [ebp - 4], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 4], 0
jne 0x4b04f3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049c780
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xb0], 0
jne 0x4b04f3
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x4b0534
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049c710
add esp, 8
mov eax, dword [ebp - 8]
mov dword [eax + 0xb0], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049c5a0
add esp, 0xc
xor eax, eax
jmp 0x4b0555
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004af820
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.004b1080
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4b91b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.004db54e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x4b91e9
jmp 0x4b9200
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0x10]
jb 0x4b91bd
cmp dword [ebp - 4], 0
jge 0x4b922a
call fcn.004d459d
mov eax, dword [eax]
push eax
call fcn.004d5383
add esp, 4
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b8eb0
add esp, 0xc
or eax, 0xffffffff
jmp 0x4b923c
cmp dword [ebp - 4], 0
jne 0x4b923a
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ce580
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.cw]
mov byte [edx], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.cw]
mov byte [eax + 4], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 8]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 8], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.cw]
mov byte [edx + 0xc], al
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 1]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.cw]
mov byte [edx + 1], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 9]
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.cw]
mov byte [eax + 5], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xd]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 9], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 0xd], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 2]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xa]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 2], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 0xa], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xe]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 6], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 0xe], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0xf]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + str.cw]
mov byte [ecx + 0xf], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 7]
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.cw]
mov byte [edx + 0xb], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 3]
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.cw]
mov byte [eax + 7], cl
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
mov cl, byte [edx + str.cw]
mov byte [eax + 3], cl
mov esp, ebp
pop ebp
ret
Function at 0x4cebd0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4ee200]
mov byte [edx], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4ee200]
mov byte [eax + 4], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 8]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 8], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4ee200]
mov byte [edx + 0xc], al
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0xd]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 9]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4ee200]
mov byte [edx + 0xd], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4ee200]
mov byte [eax + 9], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 5], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 1], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 2]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xa]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 2], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 0xa], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xe]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 6], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 0xe], dl
mov eax, dword [ebp + 8]
mov cl, byte [eax + 3]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 7]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4ee200]
mov byte [ecx + 3], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4ee200]
mov byte [edx + 7], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xf]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4ee200]
mov byte [eax + 0xb], cl
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4ee200]
mov byte [eax + 0xf], cl
mov esp, ebp
pop ebp
ret
Function at 0x4cf2c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xd]
movzx edx, byte [ecx + str.cw]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xe]
movzx edx, byte [ecx + str.cw]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xf]
movzx edx, byte [ecx + str.cw]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx + 2], cl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + str.cw]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx + 3], cl
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
shl ecx, 1
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
sar eax, 7
and eax, 1
imul eax, eax, 0x11b
xor ecx, eax
mov edx, dword [ebp + 0xc]
mov byte [edx], cl
mov byte [ebp - 1], 4
jmp 0x4cf36f
movzx eax, byte [ebp - 1]
add eax, 4
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0x10
jge 0x4cf413
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 4]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 3]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 1]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 1], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 2]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 2]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 2], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 1]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 3]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 3], dl
jmp 0x4cf365
mov esp, ebp
pop ebp
ret
Function at 0x4cf4f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0xc
jmp 0x4cf504
movzx eax, byte [ebp - 1]
sub eax, 4
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jle 0x4cf5a7
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 4]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 3]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 1]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 1], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 2]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 2]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 2], dl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax - 1]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx + 3]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax + 3], dl
jmp 0x4cf4fa
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
sar eax, 1
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x8d
xor eax, edx
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xd]
movzx ecx, byte [eax + str.cw]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xe]
movzx ecx, byte [eax + str.cw]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 1]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xf]
movzx ecx, byte [eax + str.cw]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 2]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xc]
movzx ecx, byte [eax + str.cw]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov esp, ebp
pop ebp
ret