joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d75bb
Capabilities:
Reference wmi statements

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
and dword [esp], 0
cmp dword [edx + 8], 0
mov esi, edx
mov edi, ecx
je 0x4d764a
push 0x5473be
call sub.oleaut32.dll_SysAllocString
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov ecx, dword [esi + 0xc]
mov ebp, eax
mov edx, esp
mov eax, dword [ecx]
push edx
push 0
push 0x30
push ebp
push ebx
push ecx
call dword [eax + 0x50]
mov dword [esp + 4], eax
push ebx
call sub.oleaut32.dll_SysFreeString
push ebp
call sub.oleaut32.dll_SysFreeString
cmp dword [esp + 4], 0
js 0x4d764a
mov ebx, dword [esp]
lea ecx, [esi + 0x10]
call fcn.004d4476
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], ebx
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [edi + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [edi + 0x18], eax
movsd qword [edi], xmm0
movsd qword [edi + 0x10], xmm1
jmp 0x4d7657
mov ecx, esi
mov dword [edi], 2
call fcn.004d43f9
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4d7b6d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov ecx, 0x5b7130
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4d7b8f
cmp dword [eax], 0
je 0x4d7b8f
add eax, 4
jmp 0x4d7bfc
mov ecx, 0x5b7130
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d7bea
mov edi, dword [esp + 0xc]
mov esi, eax
test eax, eax
jne 0x4d7bd8
push 0xc
pop ecx
push 4
pop edx
call fcn.00422855
and dword [eax], 0
mov ecx, 0x5b7130
mov esi, eax
mov dword [eax + 8], 0x5b7130
call fcn.004d7bff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test edi, edi
je 0x4d7bee
mov ecx, dword [edi]
and dword [edi], 0
test ecx, ecx
je 0x4d7bf0
mov ecx, dword [edi + 4]
jmp 0x4d7bf0
xor eax, eax
jmp 0x4d7bfc
xor ecx, ecx
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], ecx
pop esi
pop edi
ret

Function at 0x4d7bff
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [ecx]
test eax, eax
je fcn.0050d3d0
dec eax
ret

Function at 0x4d7c51
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov ecx, 0x5b7140
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4d7c73
cmp dword [eax], 0
je 0x4d7c73
add eax, 4
jmp 0x4d7ce0
mov ecx, 0x5b7140
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d7cce
mov edi, dword [esp + 0xc]
mov esi, eax
test eax, eax
jne 0x4d7cbc
push 0xc
pop ecx
push 4
pop edx
call fcn.00422855
and dword [eax], 0
mov ecx, 0x5b7140
mov esi, eax
mov dword [eax + 8], 0x5b7140
call fcn.004d7bff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test edi, edi
je 0x4d7cd2
mov ecx, dword [edi]
and dword [edi], 0
test ecx, ecx
je 0x4d7cd4
mov ecx, dword [edi + 4]
jmp 0x4d7cd4
xor eax, eax
jmp 0x4d7ce0
xor ecx, ecx
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], ecx
pop esi
pop edi
ret
Function at 0x4dcb3d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4dcb3f
test al, 1
je 0x4dcb56
test al, 2
jne 0x4dcb65
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x549460
jmp 0x4dcb72
push 0x25
pop edx
mov ecx, 0x549470
push 0x549498
call fcn.0050af40
pop eax
ud2

Function at 0x4dd27a
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
mov bl, byte [esp + 0x10]
mov esi, ecx
mov ecx, edx
call fcn.004dc33c
mov eax, dword [eax + 4]
movzx ecx, bl
mov edx, esp
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call sub.ws2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x4dd2bc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
ret
Function at 0x4dd52e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x58]
cmp dword [edx + 4], 0xffffffff
mov dword [esp], ecx
mov ecx, 0
mov esi, 0x7fffffff
mov edi, edx
lea ebp, [esp + 0x10]
cmovne ecx, edx
cmp eax, esi
cmovb esi, eax
lea eax, [edx + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], eax
mov edx, dword [edi + 0x10]
mov ecx, ebp
push dword [esp + 0x50]
call fcn.004dd26c
pop eax
mov edx, dword [esp + 0x10]
cmp edx, 2
je 0x4dd6ae
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test edx, edx
jne 0x4dd6b6
mov esi, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, 0x5480bc
mov dword [esp + 0x38], eax
mov ecx, esi
call fcn.00433692
push 0
push dword [esp + 0x34]
push dword [esp + 0x5c]
push dword [esi + 4]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x4dd5d0
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x4dd654
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esp + 4], cl
and word [esp + 5], 0
mov byte [esp + 7], cl
lea ecx, [esp + 4]
mov dword [esp + 8], eax
call fcn.004245d0
cmp al, 0xd
jne 0x4dd654
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov byte [esp + 0x10], 4
test eax, eax
je 0x4dd637
mov esi, dword [eax + 8]
mov edx, dword [eax + 4]
lock inc dword [esi]
jle 0x4dd6d8
add edx, 8
lea ecx, [esp + 0x1c]
push dword [eax + 0xc]
push dword [eax]
push esi
call fcn.0043c9bb
add esp, 0xc
mov ecx, ebp
call fcn.004bf244
mov al, byte [esp + 0x1c]
jmp 0x4dd647
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
cmp al, 4
je 0x4dd654
mov ebx, dword [esp + 0x1c]
cmp bl, 4
jne 0x4dd697
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
je 0x4dd6c7
lea ecx, [esp + 0x24]
call fcn.0046cad4
cmp al, 0xd
jne 0x4dd6c0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
call fcn.004dd04a
push ebp
call fcn.004d8de1
pop eax
jmp 0x4dd567
mov esi, dword [esp + 0x20]
lea ecx, [esp + 4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.004bf244
jmp 0x4dd669
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x4dd6d0
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4dd6d0
mov eax, dword [esp]
mov dword [eax], ebx
jmp 0x4dd6cd
mov eax, dword [esp]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4dd6dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
lea eax, [edx + 8]
lea esi, [esp + 0x10]
lea ebp, [esp + 4]
mov dword [esp], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
xor eax, eax
cmp dword [edx + 4], 0xffffffff
cmovne eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov ecx, esi
mov edx, dword [eax + 0x10]
push 1
push dword [esp + 0x54]
call fcn.004dd0c1
pop eax
pop ecx
mov edx, dword [esp + 0x10]
cmp edx, 2
je 0x4dd85b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test edx, edx
jne 0x4dd863
mov edi, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, 0x5480cc
mov dword [esp + 0x38], eax
mov ecx, edi
call fcn.00433692
mov eax, dword [edi + 4]
and dword [esp + 0x10], 0
push 0
push 0
push 0
mov edi, esi
push esi
push dword [esp + 0x68]
push dword [esp + 0x68]
push eax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x4dd798
mov byte [esp + 0x1c], 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], esi
cmp bl, 4
mov dword [esp + 4], ebx
jne 0x4dd81e
jmp 0x4dd874
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and dword [esp + 0x1c], 0
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x20], eax
call fcn.004245d0
cmp al, 0xd
jne 0x4dd813
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov byte [esp + 0x10], 4
test eax, eax
je 0x4dd7f6
mov ebx, dword [eax + 8]
mov edx, dword [eax + 4]
lock inc dword [ebx]
jle 0x4dd885
add edx, 8
lea ecx, [esp + 0x24]
push dword [eax + 0xc]
push dword [eax]
push ebx
call fcn.0043c9bb
add esp, 0xc
mov ecx, edi
call fcn.004bf244
mov al, byte [esp + 0x24]
jmp 0x4dd806
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
cmp al, 4
je 0x4dd813
mov ebx, dword [esp + 0x24]
cmp bl, 4
jne 0x4dd844
and dword [esp + 4], 0
xor ebx, ebx
mov dword [esp + 8], esi
mov ecx, ebp
call fcn.0046cad4
cmp al, 0xd
jne 0x4dd86d
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
call fcn.004dd04a
push ebp
call fcn.004d8de1
pop eax
mov esi, edi
jmp 0x4dd706
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.004bf244
jmp 0x4dd81e
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x4dd87d
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4dd87d
mov eax, dword [esp]
mov dword [eax], ebx
jmp 0x4dd87a
mov eax, dword [esp]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4dd8d9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push eax
mov ecx, 0x5b7120
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4dd8f8
cmp dword [eax], 0
mov esi, eax
jne 0x4dd953
mov ecx, 0x5b7120
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4dd951
mov esi, eax
test eax, eax
jne 0x4dd93d
push 8
pop ecx
push 4
pop edx
call fcn.00422855
and dword [eax], 0
mov ecx, 0x5b7120
mov esi, eax
mov dword [eax + 4], 0x5b7120
call fcn.004d7bff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.004db41c
mov edx, dword [esi]
mov ecx, esp
mov dword [ecx], edx
mov dword [esi], eax
call fcn.004db440
jmp 0x4dd953
xor esi, esi
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x4e8852
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1020
call fcn.004fc7f0
mov ebp, dword [edx]
mov ebx, dword [edx + 4]
lea edi, [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea esi, [esp + 0x20]
mov dword [edi], 0x800
push 0x1000
push 0
push esi
call fcn.004fd260
add esp, 0xc
push 0
push 0
push 0
push 0
push edi
push esi
push ebp
push dword [ebx]
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x4e88b4
cmp eax, 0x103
jne 0x4e88f6
mov eax, dword [esp + 4]
mov dword [eax], 2
jmp 0x4e8928
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push 0x57ec38
call fcn.004e8933
pop ecx
lea esi, [esp + 0x14]
mov ebx, edx
mov edx, eax
mov ecx, esi
push ebx
call fcn.00416470
pop eax
mov ecx, dword [esi + 4]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
xor edx, edx
test ecx, ecx
sete byte [esp + 3]
je 0x4e8905
mov eax, ecx
mov ecx, dword [esp + 0x14]
jmp 0x4e8908
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
xor ecx, ecx
xor edx, edx
inc edx
jmp 0x4e891a
push 9
pop eax
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov bl, byte [esp + 3]
mov dl, bl
mov ebx, dword [esp + 0xc]
inc ebp
mov dword [esi], edx
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebx
mov dword [edi], ebp
add esp, 0x1020
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e8951
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.004fc7f0
mov eax, dword [edx]
mov esi, dword [edx + 4]
mov edi, 0x800
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
mov dword [eax], edi
lea eax, [esp + 0x38]
push 0x1000
push 0
push eax
call fcn.004fd260
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, 0x800
mov dword [eax], edi
lea eax, [esp + 0x18]
and dword [eax], 0
call fcn.004df103
lea edi, [esp + 0x2c]
mov ebx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
and dword [edi + 8], 0
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
push esi
call sub.advapi32.dll_RegEnumValueW
cmp eax, 0xea
jne 0x4e89f4
mov edx, dword [esp + 0xc]
inc dword [esp + 8]
mov ecx, edi
call fcn.004e817e
mov ebx, dword [esp + 0x30]
jmp 0x4e89b7
mov ebp, eax
test eax, eax
je 0x4e8a16
cmp ebp, 0x103
jne 0x4e8a87
mov al, 0xd
mov dword [esp], eax
mov al, 1
mov dword [esp + 4], eax
jmp 0x4e8a96
mov edx, dword [esp + 8]
lea ecx, [esp + 0x38]
push 0x57ec48
call fcn.004e8933
pop ecx
mov edi, edx
lea ebp, [esp + 0x1c]
mov edx, eax
mov ecx, ebp
push edi
call fcn.00416470
pop eax
mov ebp, dword [ebp + 4]
test ebp, ebp
je 0x4e8a74
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x18]
cmp ecx, 0xc
jae 0x4e8a79
mov esi, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov edx, ecx
mov ebx, edx
mov dword [esp + 0x24], esi
movsd qword [esp + 0x1c], xmm0
jmp 0x4e8ab8
push 0xd
pop ebp
jmp 0x4e8a87
mov ecx, edi
mov edx, ebp
call fcn.0049160f
mov ebp, 0xde
mov al, 0xc
mov dword [esp + 4], 0
xor edi, edi
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edx, ebx
call fcn.0049160f
cmp byte [esp + 4], 0
je 0x4e8ab6
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp]
mov dword [ecx], edi
mov dword [ecx + 4], ebp
jmp 0x4e8ae3
mov bl, 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
movsd xmm0, qword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov dword [edx + 0x14], ecx
mov ecx, edx
movsd qword [edx + 0xc], xmm0
mov edx, dword [esp + 0x28]
inc esi
mov dword [ecx + 4], ebp
mov dword [ecx], edi
mov dword [ecx + 8], eax
mov dword [edx], esi
mov byte [ecx + 0x18], bl
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4e9100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x4e9122
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x4ecea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x5b7168]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x54]
cmp eax, 0x80
je 0x4ecefa
cmp eax, 0x100
je 0x4ecede
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004fc928
add esp, 0x44
ret
push ecx
push ebx
call fcn.004ed830
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004fc928
add esp, 0x44
ret
push ebp
push esi
push edi
push ecx
lea eax, [esp + 0x34]
mov dword [ebx + 0xf0], 0xa
push eax
call fcn.004ed020
movups xmm0, xmmword [esp + 0x38]
add esp, 8
mov edi, 1
movups xmmword [ebx], xmm0
add ebx, 0x10
nop word [eax + eax]
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
call fcn.004ee150
lea eax, [esp + 0x14]
push eax
call fcn.004edbe0
lea eax, [esp + 0x18]
push eax
call fcn.004ee150
mov eax, dword [esp + 0x1c]
add esp, 0xc
movzx ebp, byte [edi + 0x57f6b3]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x4c], eax
xor eax, eax
mov edx, dword [esp + eax*4 + 0x40]
mov cl, al
add cl, cl
mov esi, ebp
shr esi, cl
mov ecx, edx
and ecx, 0x3000000
shr edx, 8
or ecx, edx
and esi, 3
shr ecx, 0x12
xor esi, ecx
xor esi, dword [esp + eax*4 + 0x30]
mov ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
mov dword [esp + eax*4 + 0x30], ecx
inc eax
cmp eax, 4
jb 0x4ecfa7
movups xmm0, xmmword [esp + 0x30]
inc edi
movups xmmword [ebx], xmm0
add ebx, 0x10
cmp edi, 0xa
jbe 0x4ecf30
mov ecx, dword [esp + 0x50]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fc928
add esp, 0x44
ret
Function at 0x4ed1c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [ebp]
xor dword [esi], eax
mov eax, dword [ebp + 4]
xor dword [esi + 4], eax
mov eax, dword [ebp + 8]
xor dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
xor dword [esi + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor dword [esi + 0x1c], eax
cmp ebx, 1
jbe 0x4ed259
push edi
lea edi, [ebp + 0x28]
dec ebx
push esi
call fcn.004edbe0
push esi
call fcn.004eda50
push esi
call fcn.004ed5a0
mov eax, dword [edi - 8]
lea edi, [edi + 0x20]
xor dword [esi], eax
add esp, 0xc
mov eax, dword [edi - 0x24]
xor dword [esi + 4], eax
mov eax, dword [edi - 0x20]
xor dword [esi + 8], eax
mov eax, dword [edi - 0x1c]
xor dword [esi + 0xc], eax
mov eax, dword [edi - 0x18]
xor dword [esi + 0x10], eax
mov eax, dword [edi - 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [edi - 0x10]
xor dword [esi + 0x18], eax
mov eax, dword [edi - 0xc]
xor dword [esi + 0x1c], eax
sub ebx, 1
jne 0x4ed208
mov ebx, dword [esp + 0x18]
pop edi
push esi
call fcn.004edbe0
push esi
call fcn.004eda50
shl ebx, 5
add esp, 8
mov eax, dword [ebx + ebp]
xor dword [esi], eax
mov eax, dword [ebx + ebp + 4]
xor dword [esi + 4], eax
mov eax, dword [ebx + ebp + 8]
xor dword [esi + 8], eax
mov eax, dword [ebx + ebp + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [ebx + ebp + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [ebx + ebp + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [ebx + ebp + 0x18]
xor dword [esi + 0x18], eax
mov eax, dword [ebx + ebp + 0x1c]
xor dword [esi + 0x1c], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4ed3a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5b7168]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push edi
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc], xmm0
movups xmm0, xmmword [eax + 0x10]
lea eax, [esp + 0xc]
push eax
movups xmmword [esp + 0x20], xmm0
call fcn.004ee150
xor edi, edi
add esp, 4
mov dword [esp + 4], edi
cmp dword [esp + 0x38], edi
jbe 0x4ed590
push ebx
lea eax, [ecx + 8]
push ebp
mov dword [esp + 0x10], eax
push esi
nop
mov ecx, dword [esp + edi*4 + 0x30]
mov eax, dword [esp + edi*4 + 0x28]
movzx eax, al
mov ebx, dword [esp + edi*4 + 0x20]
movzx edx, cl
shl edx, 8
or edx, eax
mov esi, dword [esp + edi*4 + 0x28]
shl edx, 8
movzx eax, bl
or edx, eax
mov eax, dword [esp + edi*4 + 0x18]
movzx eax, al
shl edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov ebp, eax
shl ebp, 6
xor ebp, eax
mov eax, dword [esp + edi*4 + 0x30]
shr eax, 8
xor ebp, edx
movzx edx, al
mov eax, esi
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov eax, dword [esp + edi*4 + 0x18]
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov edi, eax
shl edi, 6
xor edi, eax
mov eax, dword [esp + ecx*4 + 0x30]
shr eax, 0x10
xor edi, edx
movzx edx, al
mov eax, esi
shr eax, 0x10
movzx eax, al
shl edx, 8
or edx, eax
mov eax, ebx
shr eax, 0x10
shl edx, 8
movzx eax, al
or edx, eax
mov eax, dword [esp + ecx*4 + 0x18]
shl edx, 8
shr eax, 0x10
and ebx, 0xff00ffff
movzx eax, al
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov esi, eax
shl esi, 6
xor esi, eax
mov eax, dword [esp + ecx*4 + 0x28]
xor esi, edx
and eax, 0xff0000ff
mov edx, dword [esp + ecx*4 + 0x18]
shr edx, 8
or edx, ebx
shr edx, 8
or edx, eax
mov eax, dword [esp + ecx*4 + 0x30]
and eax, 0xff000000
shr edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov ecx, eax
shl ecx, 6
xor ecx, eax
mov eax, dword [esp + 0x14]
xor ecx, edx
mov dword [eax - 8], ebp
mov dword [eax - 4], edi
mov edi, dword [esp + 0x10]
mov dword [eax], esi
inc edi
mov dword [eax + 4], ecx
add eax, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
cmp edi, dword [esp + 0x44]
jb 0x4ed3f0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
pop edi
xor ecx, esp
call fcn.004fc928
add esp, 0x2c
ret
Function at 0x4ed830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x5b7168]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x3c]
push edi
mov edi, dword [esp + 0x58]
push esi
push eax
mov dword [edi + 0xf0], 0xe
call fcn.004ed020
movups xmm0, xmmword [esp + 0x48]
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
movups xmmword [edi], xmm0
call fcn.004ed020
movups xmm4, xmmword [esp + 0x40]
add esp, 0x10
lea ebp, [edi + 0x20]
mov ebx, 2
movups xmmword [edi + 0x10], xmm4
nop dword [eax]
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movups xmmword [esp + 0x10], xmm0
push eax
movups xmmword [esp + 0x24], xmm0
movaps xmm0, xmm4
movd dword [esp + 0x14], xmm4
psrldq xmm0, 4
movd dword [esp + 0x1c], xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
movd dword [esp + 0x24], xmm0
movaps xmm0, xmm4
psrldq xmm0, 0xc
movd dword [esp + 0x2c], xmm0
call fcn.004ee150
lea eax, [esp + 0x14]
push eax
call fcn.004edbe0
lea eax, [esp + 0x18]
push eax
call fcn.004ee150
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov eax, ebx
shr eax, 1
mov cl, byte [eax + 0x57f6b3]
xor eax, eax
movzx edi, cl
nop dword [eax]
mov edx, dword [esp + eax*4 + 0x30]
mov cl, al
add cl, cl
mov esi, edi
shr esi, cl
mov ecx, edx
and ecx, 0x3000000
shr edx, 8
or ecx, edx
and esi, 3
shr ecx, 0x12
xor esi, ecx
xor esi, dword [esp + eax*4 + 0x40]
mov ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
mov dword [esp + eax*4 + 0x40], ecx
inc eax
cmp eax, 4
jb 0x4ed920
movups xmm0, xmmword [esp + 0x40]
movups xmmword [ebp], xmm0
cmp ebx, 0xe
je 0x4eda39
mov eax, dword [esp + 0x40]
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
call fcn.004ee150
lea eax, [esp + 0x14]
push eax
call fcn.004edbe0
lea eax, [esp + 0x18]
push eax
call fcn.004ee150
mov eax, dword [esp + 0x1c]
add ebx, 2
mov dword [esp + 0x3c], eax
add esp, 0xc
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov eax, 0x18
movups xmm2, xmmword [esp + 0x30]
movd xmm3, eax
mov eax, 8
psrld xmm2, xmm3
pxor xmm2, xmm4
movd xmm0, eax
movaps xmm4, xmm2
mov eax, 0x10
movaps xmm1, xmm2
pslld xmm4, xmm0
pxor xmm4, xmm2
movd xmm0, eax
pslld xmm1, xmm0
pslld xmm2, xmm3
pxor xmm4, xmm1
pxor xmm4, xmm2
movups xmmword [ebp + 0x10], xmm4
add ebp, 0x20
cmp ebx, 0xe
jbe 0x4ed890
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fc928
add esp, 0x44
ret
Function at 0x4ef560
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret