joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46062f
Capabilities:
Check os version
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push esi
push ebx
mov esi, sym.imp.WS2_32.dll_closesocket
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov edi, dword [ebx]
cmp edi, 0xffffffff
jne 0x4606a4
push 0
push 2
push 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x46066f
mov eax, 0
jmp 0x4607ed
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push 4
push eax
push 0x20
push 0xffff
push edi
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
or eax, eax
jge 0x4606a4
push edi
mov eax, dword [esi]
call eax
mov eax, 0
mov dword [ebx], 0xffffffff
jmp 0x4607ed
cmp dword [0x4e37a8], 0
jge 0x4606c7
push str.GHS_LMTRYLOCALBROADCAST
call fcn.0041aa6f
add esp, 4
test eax, eax
setne al
movzx eax, al
mov dword [0x4e37a8], eax
cmp dword [0x4e37a8], 0
je 0x46070e
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004a7ae0
lea eax, [ebp - 0xa0]
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
cmp dword [ebp - 0x9c], 5
jbe 0x46070e
mov dword [ebp + 0x18], 0
cmp dword [ebp + 0x18], 0
je 0x46077c
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.004602ae
sub esp, 0xffffffec
or eax, eax
jle 0x460738
mov dword [ebx], edi
mov eax, 1
jmp 0x4607ed
call fcn.00460f05
sub eax, 0x2744
jae 0x460755
sub eax, 0xfffffffe
je 0x460769
sub eax, 0xfffffff4
je 0x460769
sub eax, 0xffffffe3
je 0x460769
jmp 0x46077b
sub eax, 2
jbe 0x460769
sub eax, 4
je 0x460769
sub eax, 2
je 0x460769
sub eax, 0x21
jne 0x46077b
push edi
mov eax, dword [esi]
call eax
mov eax, 0
mov dword [ebx], 0xffffffff
jmp 0x4607ed
nop
mov dword [0x4fb850], 0xffffffff
nop
call fcn.00460310
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4607af
cmp dword [ebp - 4], 0
jne 0x4607ad
push edi
mov eax, dword [esi]
call eax
mov dword [ebx], 0xffffffff
mov eax, 0
jmp 0x4607ed
jmp 0x4607e6
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
push dword [eax + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.004602ae
add esp, 0x14
or eax, eax
jge 0x4607e4
push edi
mov eax, dword [esi]
call eax
mov dword [ebx], 0xffffffff
mov eax, 0
jmp 0x4607ed
jmp 0x460787
mov dword [ebx], edi
mov eax, 1
pop edi
pop ebx
pop esi
leave
ret
Function at 0x46089b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, 0x4fb874
push esi
push ebx
mov ebx, dword [ebp + 0x10]
mov esi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov word [eax], 2
cmp dword [ebp + 8], 1
jne 0x460a21
push 0
push 1
push 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
mov dword [ebx], eax
cmp dword [ebx], 0
jge 0x4608e1
mov eax, 0xffffffff
jmp 0x460a7a
cmp dword [ebp + 0x14], 0
je 0x460a08
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x8004667e
push dword [ebx]
call fcn.004602f2
sub esp, 0xfffffff4
cmp eax, 0xffffffff
jne 0x46090f
jmp 0x460a69
push 0x10
push dword [ebp + 0xc]
push dword [ebx]
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x46094a
call fcn.00460f05
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2734
je 0x46094a
cmp dword [ebp - 4], 0x2733
je 0x46094a
mov esi, 0xfffffffe
jmp 0x460a69
cmp dword [ebp - 8], 0
je 0x46099a
push edi
call fcn.0046005f
sub esp, 0xfffffffc
push 7
push edi
push dword [ebx]
call fcn.0045ff9c
add esp, 0xc
push edi
push 0
push dword [ebp + 0x14]
call fcn.004601e4
mov dword [ebp - 8], eax
add esp, 0xc
cmp dword [ebp - 8], 0
jg 0x46099a
cmp dword [ebp - 8], 0
jne 0x460990
push 0x274c
call fcn.00460f11
sub esp, 0xfffffffc
mov esi, 0xfffffffe
jmp 0x460a69
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
lea edi, [ebp - 4]
push eax
push edi
push 0x1007
push 0xffff
push dword [ebx]
mov eax, dword [sym.imp.WS2_32.dll_getsockopt]
call eax
or eax, eax
jge 0x4609ca
mov esi, 0xfffffffe
jmp 0x460a69
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x8004667e
push dword [ebx]
call fcn.004602f2
sub esp, 0xfffffff4
cmp eax, 0xffffffff
jne 0x4609f0
mov esi, 0xfffffffe
jmp 0x460a69
cmp dword [ebp - 4], 0
je 0x460a62
push dword [ebp - 4]
call fcn.00460f11
mov esi, 0xfffffffe
sub esp, 0xfffffffc
jmp 0x460a69
push 0x10
push dword [ebp + 0xc]
push dword [ebx]
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
test eax, eax
jge 0x460a62
mov esi, 0xfffffffe
jmp 0x460a69
cmp dword [ebp + 8], 2
jne 0x460a5b
push 0
push 2
push 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
mov dword [ebx], eax
cmp dword [ebx], 0
jge 0x460a42
mov eax, 0xffffffff
jmp 0x460a7a
push 0x10
push dword [ebp + 0xc]
push dword [ebx]
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
test eax, eax
jge 0x460a62
mov esi, 0xfffffffe
jmp 0x460a69
mov eax, 0xffffffff
jmp 0x460a7a
mov eax, 1
jmp 0x460a7a
push dword [ebx]
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
mov eax, esi
mov dword [ebx], 0xffffffff
pop ebx
pop esi
pop edi
leave
ret
Function at 0x460aa2
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, sym.imp.WS2_32.dll_closesocket
push esi
push edi
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 8], 1
jne 0x460c57
push 0
push 1
push 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
mov dword [esi], eax
cmp dword [esi], 0
jge 0x460adb
mov eax, 0xffffffff
jmp 0x460c63
mov dword [ebp - 8], 1
mov word [ebp - 0x18], 2
movzx eax, word [ebp + 0xc]
push eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
lea edi, [ebp - 0x18]
mov word [ebp - 0x16], ax
mov dword [ebp - 0x14], 0
push 0x10
push edi
push dword [esi]
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
test eax, eax
jge 0x460c1e
cmp dword [ebp + 0x18], 0
je 0x460b42
call fcn.00460f05
mov edi, eax
push dword [esi]
mov eax, dword [ebx]
call eax
mov dword [esi], 0xffffffff
push edi
call fcn.00460f11
mov eax, 0xfffffffd
sub esp, 0xfffffffc
jmp 0x460c63
push 0x4e37c4
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
lea edi, [ebp - 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0
push edi
push eax
push 1
call fcn.0046089b
sub esp, 0xfffffff0
cmp eax, 1
jne 0x460ba4
push dword [ebp - 4]
mov eax, dword [ebx]
call eax
push 0x2740
call fcn.00460f11
sub esp, 0xfffffffc
call fcn.00460f05
mov edi, eax
push dword [esi]
mov eax, dword [ebx]
call eax
mov dword [esi], 0xffffffff
push edi
call fcn.00460f11
mov eax, 0xfffffffd
add esp, 4
jmp 0x460c63
mov dword [ebp - 0x14], 0
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0xffff
push dword [esi]
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
test eax, eax
jge 0x460be8
call fcn.00460f05
push dword [esi]
mov edi, eax
mov eax, dword [ebx]
call eax
mov dword [esi], 0xffffffff
push edi
call fcn.00460f11
mov eax, 0xfffffffe
add esp, 4
jmp 0x460c63
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [esi]
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
test eax, eax
jge 0x460c1e
call fcn.00460f05
push dword [esi]
mov edi, eax
mov eax, dword [ebx]
call eax
mov dword [esi], 0xffffffff
push edi
call fcn.00460f11
add esp, 4
mov eax, 0xfffffffd
jmp 0x460c63
cmp dword [ebp + 0x14], 0
je 0x460c5e
push dword [ebp + 0x14]
push dword [esi]
mov eax, dword [sym.imp.WS2_32.dll_listen]
call eax
test eax, eax
jge 0x460c5e
call fcn.00460f05
push dword [esi]
mov edi, eax
mov eax, dword [ebx]
call eax
mov dword [esi], 0xffffffff
push edi
call fcn.00460f11
sub esp, 0xfffffffc
mov eax, 0xfffffffc
jmp 0x460c63
mov eax, 0xffffffff
jmp 0x460c63
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461399
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0x4e38d0
mov eax, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call eax
mov ebx, eax
cmp ebx, 0
jne 0x4613e3
push 0
push 0
lea ebx, [ebp - 4]
push 0
push 0
push ebx
push 0
push 0
push 0
mov eax, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
cmp eax, 4
jb 0x461408
cmp ebx, 0
je 0x461408
lea eax, [ebp - 4]
mov edi, 4
push 4
push eax
push esi
call fcn.004a86b0
sub esp, 0xfffffff4
mov eax, edi
jmp 0x46140d
mov eax, 0
pop ebx
pop esi
pop edi
leave
ret

Function at 0x462818
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0xdeadbeef
mov esi, dword [ebp + 8]
nop
xor dword [esi + eax*4], edi
add eax, 1
cmp eax, 2
jl 0x46282f
mov dword [ebp - 8], 0
mov ebx, 2
jmp 0x462866
mov eax, dword [esi + ebx*4]
xor eax, edi
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [esi + ebx*4], eax
push dword [ebp - 8]
call fcn.00460f24
sub esp, 0xfffffffc
mov edi, eax
add ebx, 1
cmp ebx, dword [ebp + 0xc]
jl 0x462848
mov edx, dword [ebp + 0xc]
lea edi, [edx - 1]
mov ecx, dword [esi + edi*4]
mov edi, 0
mov dword [ebp - 4], ecx
jmp 0x46288d
mov eax, dword [esi + edi*4]
push eax
call sub.WS2_32.dll_htonl
mov dword [esi + edi*4], eax
add edi, 1
cmp edi, dword [ebp + 0xc]
jl 0x46287e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468c50
Capabilities:
Get common file path

Disassembly:
add esp, 0xffffff7c
lea eax, [esp]
push ebx
push esi
push edi
push ebp
push eax
call fcn.004beed4
lea eax, [esp + 0x18]
mov ebx, dword [esp + 0x14]
add esp, 4
sub ebx, 0xfffeae80
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x7f
push eax
call esi
or eax, eax
jne 0x468c91
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
lea ebp, [esp + eax + 0x14]
push 0
push 0xa
push 9
push 0x71
push 0x75
push 0x6f
push 0x33
push 0x72
push 0x6c
push 0x79
push 0x5d
call fcn.0046afd0
mov edi, eax
mov ecx, 0xffffffff
sub esp, 0xffffffd4
push ebx
not ecx
sub eax, eax
repne scasb al, byte es:[edi]
sub edi, ecx
mov esi, edi
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.0046f1a0
sub esp, 0xfffffff8
test eax, eax
je 0x468cf6
pop ebp
pop edi
pop esi
mov eax, 0xd
pop ebx
sub esp, 0xffffff7c
ret
push 0
push 0xf
push 0xe
push 0xd
push 0xc
push 0x74
push 0x78
push 0x72
push 0x36
push 0x74
push 0x6b
push 0x79
push 0x77
push 0x7c
push 0x75
push 0x5d
call fcn.0046afd0
mov ecx, 0xffffffff
not ecx
mov edi, eax
sub esp, 0xffffffc0
push ebx
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.0046f1a0
add esp, 8
or eax, eax
je 0x468d61
pop ebp
mov eax, 0xe
pop edi
pop esi
pop ebx
sub esp, 0xffffff7c
ret
push 0
push 0xa
push 0x79
push 0x7a
push 0x6e
push 0x34
push 0x73
push 0x6d
push 0x64
push 0x6f
push 0x5d
call fcn.0046afd0
mov edi, eax
mov ecx, 0xffffffff
add esp, 0x2c
not ecx
push ebx
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.0046f1a0
sub esp, 0xfffffff8
test eax, eax
je 0x468dc2
pop ebp
pop edi
pop esi
mov eax, 0xf
pop ebx
add esp, 0x84
ret
lea eax, [esp + 0x14]
push 0x7f
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call edi
mov ebp, eax
or ebp, ebp
jne 0x468de4
pop ebp
xor eax, eax
pop edi
pop esi
pop ebx
sub esp, 0xffffff7c
ret
push 0
push 0xf
push 0x7b
push 0x72
push 0x80
push 0x7e
push 0x83
push 0x7c
push 0x64
push 0x6e
push 0x6f
push 0x6b
push 0x72
push 0x72
push 0x65
push 0x5d
call fcn.0046afd0
mov ecx, 0xffffffff
add esp, 0x40
not ecx
mov edi, eax
sub eax, eax
repne scasb al, byte es:[edi]
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + ebp + 0x14]
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.0046f1a0
add esp, 8
pop ebp
pop edi
cmp eax, 1
pop esi
pop ebx
mov eax, 0
adc eax, 0xffffffff
and eax, 0x10
add esp, 0x84
ret
Function at 0x470a80
Capabilities:
Get disk information

Disassembly:
add esp, 0xffffffac
push edi
push esi
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebx
cmp eax, 0x80000000
jb 0x470b01
call ebx
cmp al, 4
jae 0x470b01
push str.elmid32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp eax, 0x20
ja 0x470ac3
mov eax, 0xffffffff
pop ebp
pop ebx
pop esi
pop edi
sub esp, 0xffffffac
ret
push str.MyDiskID
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x470aed
mov ecx, dword [esp + 0x68]
push ecx
call eax
push ebx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
pop ebp
pop ebx
pop esi
pop edi
sub esp, 0xffffffac
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
pop ebx
pop esi
pop edi
sub esp, 0xffffffac
mov eax, 0xffffffff
ret
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [esp + 0x1c], 0
push 0
call ebx
mov dword [esp + 0x10], eax
sub eax, 0xfffffffe
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
call ebx
mov dword [esp + 0x14], eax
test eax, eax
jne 0x470b48
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop ebp
pop ebx
pop esi
pop edi
sub esp, 0xffffffac
ret
mov esi, edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp byte [esi], 0
je 0x470bb8
push esi
call ebp
cmp eax, 3
jne 0x470b88
lea ecx, [esp + 0x44]
push 0x20
lea eax, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x34]
push eax
push 0x20
push ecx
push esi
call ebx
cmp eax, 1
je 0x470b98
push 0
push esi
call fcn.004a8cc0
sub esp, 0xfffffff8
lea esi, [eax + 1]
jmp 0x470b56
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x1c]
push eax
push str._08lx
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x24], 1
sub esp, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
pop esi
pop edi
sub esp, 0xffffffac
ret
Function at 0x472580
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xfffffff8
push ebx
push esi
mov ebx, dword [esp + 0x14]
push edi
cmp dword [ebx + 0x44ec], 0
je 0x4725de
cmp ebx, 0xffffbb10
mov ecx, dword [esp + 0x1c]
je 0x4725e2
test ecx, ecx
je 0x4725e2
lea edi, [ebx + 0x44f0]
mov dl, byte [edi]
cmp byte [ecx], dl
jne 0x4725e2
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4725d1
or dl, dl
je 0x4725cd
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4725d1
sub edi, 0xfffffffe
sub esi, 0xfffffffe
or dl, dl
jne 0x4725b1
xor edi, edi
jmp 0x4725d6
sbb edi, edi
sbb edi, 0xffffffff
test edi, edi
jne 0x4725e2
xor eax, eax
jmp 0x4725e7
mov ecx, dword [esp + 0x1c]
mov eax, 1
or eax, eax
mov edi, dword [esp + 0x20]
jne 0x4725fb
cmp dword [ebx + 0x45f4], edi
je 0x4726a0
or eax, eax
je 0x472614
lea eax, [ebx + 0x44f0]
push 0x100
push ecx
push eax
call fcn.0046abb0
sub esp, 0xfffffff4
sub eax, eax
mov esi, 0xffffffff
lea edx, [esp + 0xc]
not esi
mov dword [ebx + 0x45f4], edi
lea edi, [ebx + 0x44f0]
repne scasb al, byte es:[edi]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
dec esi
test esi, esi
jle 0x47265a
lea eax, [ecx + 2]
inc ecx
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov dl, byte [ecx + ebx + 0x44ef]
xor byte [esp + eax + 0xc], dl
cmp esi, ecx
jg 0x47263b
xor edi, edi
lea ecx, [edi*8]
mov edx, dword [ebx + 0x45f4]
sar edx, cl
xor byte [esp + edi + 0xc], dl
inc edi
cmp edi, 4
jl 0x47265c
xor edi, edi
mov esi, 0xfb
xor eax, eax
lea ecx, [esp + edi + 0xc]
inc edi
mov al, byte [ecx]
lea eax, [eax + eax*2]
cdq
cmp edi, 8
idiv esi
mov byte [ecx], dl
jl 0x472677
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00475580
sub esp, 0xfffffff8
mov dword [ebx + 0x44ec], 1
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x475580
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x10]
push edi
xor ebx, ebx
cmp dword [ebp + 0x3ce4], ebx
jle 0x4755f4
mov esi, dword [esp + 0x18]
lea edi, [ebp + 0x2be4]
push 8
push edi
push esi
call fcn.00475950
add esp, 0xc
or eax, eax
jne 0x4755bd
sub edi, 0xfffffef0
inc ebx
cmp dword [ebp + 0x3ce4], ebx
jg 0x47559c
jmp 0x4755f8
pop edi
mov eax, ebx
shl eax, 4
add eax, ebx
shl eax, 4
lea ebx, [eax + ebp + 0x2bec]
lea edx, [eax + ebp]
mov dword [ebp + 0x2bd8], ebx
pop esi
lea eax, [edx + 0x2bf4]
sub edx, 0xffffd38c
mov dword [ebp + 0x2bdc], eax
mov dword [ebp + 0x2be0], edx
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x18]
mov edx, dword [ebp + 0x3ce4]
inc edx
mov dword [ebp + 0x3ce4], edx
cmp edx, 0x10
jle 0x475614
mov dword [ebp + 0x3ce4], 0x10
mov edi, dword [ebp + 0x3ce4]
dec edi
mov ecx, edi
mov eax, dword [esi]
shl ecx, 4
add ecx, edi
shl ecx, 4
add ecx, ebp
lea edi, [ecx + 0x2be4]
mov dword [edi], eax
mov edx, dword [esi + 4]
mov dword [edi + 4], edx
lea edx, [ecx + 0x2bf4]
sub ecx, 0xffffd38c
lea edi, [ecx - 0x88]
mov dword [ebp + 0x2bd8], edi
xor edi, edi
mov dword [ebp + 0x2bdc], edx
mov dword [ebp + 0x2be0], ecx
mov eax, dword [ebp + 0x2bd8]
mov dword [eax], edi
mov dword [eax + 4], edi
mov ebx, 3
mov eax, edi
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov cl, byte [esi + eax]
mov eax, edi
cdq
and cl, 0xfe
idiv ebx
mov al, byte [esi + edx]
inc edi
shr al, 1
mov edx, dword [ebp + 0x2bd8]
xor cl, al
cmp edi, 8
mov byte [edx + edi - 1], cl
jl 0x475668
push 0
mov eax, dword [ebp + 0x2bdc]
push esi
push eax
call fcn.00475810
add esp, 0xc
mov eax, dword [ebp + 0x2be0]
push 1
push esi
push eax
call fcn.00475810
add esp, 0xc
cmp dword [ebp + 0x3ce8], 0
je 0x4756de
push ebp
call fcn.004756f0
mov dword [ebp + 0x3ce8], 0
sub esp, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4756f0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push edi
push esi
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dl, byte [ecx + 0x4e95f0]
sub edx, eax
cmp edx, 1
je 0x475712
inc ecx
cmp ecx, 0x20
jl 0x4756fb
jmp 0x475716
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x20
jl 0x4756f9
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x10]
and edi, 1
shl edi, 4
mov dword [eax + ecx*4 + 0x3cec], 0
xor ebx, ebx
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
and esi, 0x1e
shr esi, 1
or edi, esi
and ecx, 0x20
or edi, ecx
xor edx, edx
mov esi, 8
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx + edi + 0x4e9610]
mov cl, bl
sar esi, cl
test esi, edx
je 0x4757a2
mov edx, 1
mov cl, 0x1f
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
add ebp, ebx
add esi, dword [esp + 0x10]
sub cl, byte [esp + ebp + 0x1c]
shl edx, cl
or dword [eax + esi*4 + 0x3cec], edx
inc ebx
cmp ebx, 4
jl 0x475766
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x40
jl 0x475732
sub dword [esp + 0x18], 0xfffffffc
add dword [esp + 0x14], 0x40
cmp dword [esp + 0x14], 0x200
jl 0x47572a
mov ebx, 8
xor edx, edx
add eax, 0x3cec
mov ecx, 0x40
mov esi, dword [eax]
mov ebp, esi
inc edx
add esi, esi
shr ebp, 0x1f
or ebp, esi
mov dword [eax], ebp
cmp edx, 4
jne 0x4757f5
xor edx, edx
add eax, 4
dec ecx
jne 0x4757e0
dec ebx
jne 0x4757db
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x475810
Capabilities:
Encrypt data using des

Disassembly:
mov edx, dword [esp + 8]
add esp, 0xffffff88
push ebx
push edi
push esi
xor eax, eax
push ebp
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax + 0x4e9810]
dec ebx
mov edi, ebx
and ebx, 7
sar edi, 3
mov cl, byte [edi + edx]
and ecx, dword [ebx*4 + 0x4e9888]
cmp ecx, 1
sbb bl, bl
inc eax
inc bl
cmp eax, 0x38
mov byte [esp + eax + 0x17], bl
jl 0x47581d
mov esi, dword [esp + 0x8c]
xor edi, edi
xor eax, eax
lea edx, [esp + 0x10]
mov dword [edx], 0
mov dword [edx + 4], 0
mov ebx, edi
cmp dword [esp + 0x94], 0
je 0x47587a
mov ebx, 0xf
sub ebx, edi
xor ecx, ecx
cmp eax, 0x1c
mov ebp, 0x38
mov cl, byte [ebx + 0x4e9848]
lea edx, [ecx + eax]
jge 0x475894
mov ebp, 0x1c
cmp ebp, edx
jg 0x47589b
sub edx, 0x1c
mov dl, byte [esp + edx + 0x18]
inc eax
cmp eax, 0x38
mov byte [esp + eax + 0x4f], dl
jl 0x475867
xor ecx, ecx
xor ebx, ebx
mov bl, byte [ecx + 0x4e9858]
cmp byte [esp + ebx + 0x4f], 0
je 0x4758de
mov eax, ecx
mov ebx, 6
cdq
mov ebp, 6
idiv ebx
lea ebx, [esp + eax + 0x10]
mov eax, ecx
cdq
idiv ebp
mov eax, dword [edx*4 + 0x4e9888]
sar eax, 2
or byte [ebx], al
inc ecx
cmp ecx, 0x30
jl 0x4758ab
xor ecx, ecx
mov cl, byte [esp + 0x10]
xor ebx, ebx
mov bl, byte [esp + 0x14]
shl ecx, 0x10
or ecx, ebx
xor eax, eax
shl ecx, 8
mov al, byte [esp + 0x12]
shl eax, 0x10
or ecx, eax
xor eax, eax
mov al, byte [esp + 0x16]
or ecx, eax
xor edx, edx
mov dl, byte [esp + 0x15]
mov dword [esi], ecx
xor eax, eax
mov al, byte [esp + 0x11]
shl eax, 0x10
or eax, edx
xor edx, edx
shl eax, 8
mov dl, byte [esp + 0x13]
shl edx, 0x10
add esi, 8
or eax, edx
inc edi
xor edx, edx
mov dl, byte [esp + 0x17]
or eax, edx
mov dword [esi - 4], eax
cmp edi, 0x10
jl 0x475854
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x78
ret

Function at 0x475980
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x10
cdq
push edi
push ebx
xor eax, edx
sub eax, edx
and eax, 0
push esi
push ebp
xor eax, edx
sub eax, edx
je 0x4759a6
pop ebp
pop esi
pop ebx
mov eax, 0xffffffe2
pop edi
add esp, 0x10
ret
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
xor edi, edi
mov ebx, dword [ebp + 0x2bd8]
cmp dword [esp + 0x30], edi
mov edx, dword [ebx]
mov dword [ecx], edx
mov ebx, dword [ebx + 4]
mov dword [ecx + 4], ebx
jle 0x475a24
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x18]
lea eax, [esp + 0x10]
push ecx
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x2bdc]
push edx
push ebp
call fcn.00474af0
sub esp, 0xfffffff4
xor ecx, ecx
lea edx, [edi + ecx]
mov al, byte [esi + edx]
inc ecx
xor al, byte [esp + ecx + 0x1e]
mov byte [ebx + edx], al
cmp ecx, 1
jl 0x4759f3
mov edx, 6
mov al, byte [esp + edx + 0x10]
mov byte [esp + edx + 0x11], al
dec edx
jns 0x475a0b
mov al, byte [ebx + edi]
inc edi
mov byte [esp + 0x10], al
cmp edi, dword [esp + 0x30]
jl 0x4759ce
pop ebp
pop esi
xor eax, eax
pop ebx
pop edi
add esp, 0x10
ret