joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428490
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov edx, str.set_file_block_mode
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.004233a0
test eax, eax
je 0x4284d0
mov edx, dword [eax + 4]
test edx, edx
je 0x4284d0
cmp dword [eax], 0x529430
je 0x4284e3
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], pe_nt_image_headers32
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
lea edx, [ebp - 0xc]
xor ebx, 1
mov dword [esp + 8], edx
movzx ebx, bl
mov dword [esp + 4], 0x8004667e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
sub esp, 0xc
test edx, edx
mov eax, 1
je 0x4284c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.00423500
xor eax, eax
jmp 0x4284c8
Function at 0x42a550
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.00424320
test eax, eax
je 0x42a5a0
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.0042a160
cmp eax, 0xffffffff
je 0x42a594
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004b2a38

Function at 0x42b170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 8
call fcn.00513a20
mov ebx, dword [sym.imp.msvcrt.dll__beginthreadex]
mov dword [eax], 0x42d2e0
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x42abb0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x42b243
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
call esi
sub esp, 4
mov dword [esp], 8
call fcn.00513a20
mov dword [eax], 0x42ace0
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x42abb0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x42b237
mov dword [esp], 0
call esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.cannot_create_power_notification_thread
call fcn.00411840
mov dword [esp], str.cannot_create_device_poll_thread
call fcn.00411840
nop

Function at 0x42e370
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0042d970
mov dword [esp + 0x20], ebx
add esp, 0x18
pop ebx
jmp fcn.0042dfc0
Function at 0x42f600
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x42f70b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x42f690
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x42f620
mov ecx, edx
jmp 0x42f6cb
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x42f6d3
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x42f6be
mov ecx, edx
xor eax, eax
jmp 0x42f6cb
Function at 0x43e1d0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x43e1fe
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x43e1e7
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x43e1fa

Function at 0x43e210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x43e238
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x43e224
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret
Function at 0x44c280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov eax, 0x56f508
mov ebp, esp
mov ecx, 0x44c0b0
push edi
mov edx, 0x44bf40
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
call fcn.0044bf80
mov eax, dword [0x56f500]
test eax, eax
jne 0x44c300
mov eax, dword [0x56f504]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov edi, eax
je 0x44c313
mov dword [esp], 0x56f51c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x56f50c], eax
sub esp, 4
mov dword [esp], 0x56f51c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [ebp + 0x10]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
mov edi, eax
je 0x44c300
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x56f504]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x44c2c0
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call fcn.004b2a58
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
jmp 0x44c2f5
Function at 0x468bf0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
lea esi, [edi + 0x7e]
mov dword [esp + 0x18], eax
mov edi, 5
mov dword [esp + 0x10], 3
mov ecx, ebx
mov eax, edx
shr ebx, 0x10
shr edx, 0x10
mov word [esp], ax
movzx eax, word [esp]
rol dx, 0xb
sub esi, 8
rol word [esp], 0xd
mov ebp, eax
not ebp
and ebp, ecx
sub edx, ebp
mov ebp, eax
movzx eax, word [esi + 6]
and ebp, ebx
sub edx, ebp
mov ebp, ebx
sub dx, word [esi + 8]
not ebp
and ebp, edx
sub word [esp], bp
mov ebp, ebx
and ebp, ecx
sub word [esp], bp
mov ebp, ecx
sub word [esp], ax
not ebp
movzx eax, word [esp]
rol bx, 0xe
and ebp, eax
sub ebx, ebp
mov ebp, edx
and ebp, ecx
sub ebx, ebp
mov ebp, edx
sub bx, word [esi + 4]
not ebp
rol cx, 0xf
and ebp, ebx
sub ecx, ebp
mov ebp, eax
and ebp, edx
sub ecx, ebp
sub cx, word [esi + 2]
sub edi, 1
jne 0x468c24
sub dword [esp + 0x10], 1
je 0x468ce0
xor eax, eax
mov ebp, dword [esp]
cmp dword [esp + 0x10], 2
sete al
and ebp, 0x3f
mov edi, eax
mov eax, dword [esp + 0x14]
add edi, 5
sub dx, word [eax + ebp*2]
mov ebp, ebx
and ebp, 0x3f
movzx ebp, word [eax + ebp*2]
sub word [esp], bp
mov ebp, ecx
and ebp, 0x3f
sub bx, word [eax + ebp*2]
mov ebp, edx
and ebp, 0x3f
sub cx, word [eax + ebp*2]
jmp 0x468c24
movzx eax, word [esp]
shl ebx, 0x10
movzx ecx, cx
mov edi, dword [esp + 0x18]
shl edx, 0x10
or ebx, ecx
or edx, eax
mov dword [edi], ebx
mov dword [edi + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4711b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov eax, dword [edx]
cmp eax, dword [ecx]
je 0x471201
mov dword [esp + 0x10], 0x332
mov dword [esp + 0xc], str.external_boringssl_src_crypto_ec_ec.c
mov dword [esp + 8], 0x6a
mov dword [esp + 4], 0
mov dword [esp], 0xf
call sym.adb.exe_ERR_put_error
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp eax, dword [ebx]
jne 0x4711cc
cmp eax, dword [esi]
jne 0x4711cc
add esp, 0x20
pop ebx
pop esi
pop edi
jmp fcn.004750c0
Function at 0x479d10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov edi, dword [esp + 0x140]
mov esi, dword [esp + 0x148]
test ebx, ebx
je 0x479e7f
cmp ebx, dword [edi]
je 0x479e81
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
cmp eax, esi
jb 0x479e50
mov eax, dword [esp + 0x144]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], esi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x1c], esi
cmp esi, 0x80
je 0x479d96
mov eax, pe_nt_image_headers32
sub eax, esi
add esi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x479d98
mov eax, dword [esp + 0x150]
lea esi, [edi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x479e72
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x479e72
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x479df6
mov eax, dword [esp + 0x150]
lea ebp, [edi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x479e72
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x479e72
mov dword [edi], ebx
jmp 0x479e93
mov edx, dword [esp + 0x150]
lea eax, [edi + 4]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x479eac
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x479d3f
lea esi, [edi + 0x14]
add edi, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call sym.adb.exe_EVP_MD_CTX_copy_ex
test eax, eax
setne al
movzx eax, al
jmp 0x479e74
mov eax, dword [esp + 0x144]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x479e72
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
lea ebp, [esp + 0xa0]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym.adb.exe_EVP_DigestFinal_ex
test eax, eax
je 0x479e72
mov esi, dword [esp + 0x1c]
jmp 0x479d71
Function at 0x47a1d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x47a220
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x47a21d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x47a1f0
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x47a660
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x47a6c0
test edi, 2
jne 0x47a6d0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x47a691
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x47a699
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x47a67a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47a67a

Function at 0x47af30
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x47af90
test edi, 2
jne 0x47afa0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x47af61
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x47af69
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x47af4a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47af4a

Function at 0x47ba20
Capabilities:
Hash data with md5

Disassembly:
push edi
mov eax, 0x56f6c0
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x14]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD5_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_MD5_Final
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x47bd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebx, dword [eax]
test ebx, ebx
je 0x47bdeb
mov eax, dword [esp + 0x48]
test eax, eax
je 0x47bdeb
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
jmp 0x47bdc4
test ebp, ebp
je 0x47bddf
movzx eax, byte [edi + ebx]
add edx, 1
add ebx, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x47bdc0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x48], 0xf
jbe 0x47bf01
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x54], edi
mov edi, ebp
mov ebp, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov eax, 0x10
sub eax, 1
add byte [esi + eax], 1
jne 0x47be51
test eax, eax
jne 0x47be32
cmp ebx, 0xf
ja 0x47be56
mov eax, dword [ecx + ebx]
xor eax, dword [edi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x47be44
sub dword [esp + 0x18], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0x18], 0xf
jbe 0x47be6c
xor ebx, ebx
jmp 0x47be12
mov eax, dword [esp + 0x48]
mov edi, ecx
xor ebx, ebx
mov ebp, dword [esp + 0x48]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x44], eax
add dword [esp + 0x40], eax
test ebp, ebp
jne 0x47be9e
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov eax, 0x10
sub eax, 1
movzx ecx, byte [esi + eax]
lea edx, [ecx + 1]
test dl, dl
mov byte [esi + eax], dl
jne 0x47becb
test eax, eax
jne 0x47beb6
mov ecx, dword [esp + 0x44]
lea esi, [edi + ebx]
xor eax, eax
mov edi, dword [esp + 0x40]
add ecx, ebx
add edi, ebx
lea esi, [esi]
movzx edx, byte [esi + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x47bee0
add ebx, eax
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x48]
jmp 0x47be8c
Function at 0x47bf10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov eax, dword [eax]
mov ebx, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x47bf64
test esi, esi
je 0x47bf64
mov edx, eax
mov edi, dword [esp + 0x54]
jmp 0x47bf45
test esi, esi
je 0x47bf60
movzx eax, byte [edi + edx]
add ebp, 1
add edx, 1
xor al, byte [ebp - 1]
add ecx, 1
sub esi, 1
and edx, 0xf
mov byte [ecx - 1], al
jne 0x47bf41
mov dword [esp + 0x1c], edx
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
cmp esi, 0xf
jbe 0x47bfed
mov edi, esi
shr edi, 4
mov edx, edi
add edx, eax
jae 0x47c003
neg eax
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
mov eax, 0xc
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xf], 0
nop
sub eax, 1
add byte [ebx + eax], 1
jne 0x47bfdd
test eax, eax
jne 0x47bfd0
xor eax, eax
shl edi, 4
sub esi, edi
add ecx, edi
add ebp, edi
cmp esi, 0xf
ja 0x47bf88
test esi, esi
jne 0x47c04d
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, edx
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, edx
mov byte [ebx + 0xf], dl
jmp 0x47bfdf
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 1
mov edx, eax
shr edx, 0x18
mov byte [ebx + 0xc], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0xd], dl
mov edx, eax
shr edx, 8
test eax, eax
mov byte [ebx + 0xe], dl
mov byte [ebx + 0xf], al
jne 0x47c0d8
mov al, 0xc
sub eax, 1
movzx edi, byte [ebx + eax]
lea edx, [edi + 1]
test dl, dl
mov byte [ebx + eax], dl
jne 0x47c0d8
test eax, eax
jne 0x47c0c3
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x54]
add ecx, edi
add ebx, edi
add edi, ebp
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jne 0x47c0e8
add dword [esp + 0x1c], eax
jmp 0x47bff1
Function at 0x47cb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov ebp, dword [esp + 0x48]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x168], 0
je 0x47ccc4
mov eax, dword [esp + 0x4c]
xor edx, edx
mov edi, ebp
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x47cbef
mov dword [esp + 0x48], ebp
mov ebp, esi
mov esi, dword [esp + 0x14]
nop
lea esi, [esi]
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x47cbb2
mov dword [esp + 4], esi
sub ebp, 0x10
add edi, 0x10
mov dword [esp], ebx
call fcn.0047c110
cmp ebp, 0xf
ja 0x47cbb0
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x47cc1f
mov ecx, dword [esp + 0x4c]
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, ecx
jne 0x47cc00
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0047c110
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
mov edi, edx
mov esi, eax
mov eax, esi
shrd eax, edx, 0x18
xor byte [ebx + 0xc], al
mov eax, esi
shrd eax, edi, 0x10
xor byte [ebx + 0xd], al
mov eax, esi
shrd eax, edi, 8
xor byte [ebx + 0xe], al
mov eax, esi
xor byte [ebx + 0xf], al
mov eax, dword [esp + 0x14]
xor byte [ebx + 0xb], dl
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0047c110
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
lea esi, [eax + 1]
mov eax, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x20]
mov dword [esp + 4], eax
call dword [ebx + 0x170]
mov eax, esi
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, esi
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, esi
mov byte [ebx + 0xf], al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp]
mov esi, 2
mov dword [ebx], eax
mov eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov byte [ebx + 0xf], 1
mov dword [ebx + 8], eax
jmp 0x47cc87