joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cbc0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov ebx, ecx
lea esi, [edx + 1]
push edi
mov dword [ebp - 0x24], ebx
xor edi, edi
nop word [eax + eax]
movzx edx, byte [esi - 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 3]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 2]
shl edx, 8
or edx, eax
mov dword [ebp + edi*4 - 0x128], edx
inc edi
cmp edi, 0x10
jb 0x45cbe0
cmp edi, 0x40
jae 0x45cc5f
mov ebx, 0x40
lea eax, [ebp + edi*4 - 0x130]
sub ebx, edi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x45cc22
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x28], eax
mov edi, eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x6c]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
nop dword [eax]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, edi
add esi, ecx
rol eax, 0xa
add esi, dword [edx + 0x5baf30]
add esi, dword [ebp + edx - 0x128]
mov edx, edi
add esi, dword [ebp - 0x1c]
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x20]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], edx
cmp edx, 0x100
jb 0x45cca0
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x24]
pop edi
pop esi
add dword [ebx + 0x54], ecx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x58], eax
mov eax, dword [ebp - 0x14]
add dword [ebx + 0x5c], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x60], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x64], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x6c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cd70
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push esi
mov esi, ecx
push 0x104
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x45cd9f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push 0x5c3bcc
push eax
call fcn.0051fcf6
add esp, 8
test eax, eax
je 0x45cdbd
xor ecx, ecx
mov word [eax + 2], cx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x45cd98
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45ce00
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x100
mov dword [ebp - 0x1c], edi
call fcn.004f48f1
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44
push eax
push ebx
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
jne 0x45cecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45cecd
cmp dword [ebp - 0x14], 0x44
jbe 0x45ce7e
xor bl, bl
jmp 0x45ced2
mov eax, dword [ebp - 0x10]
cmp eax, 0x80
jbe 0x45ceb2
xor ecx, ecx
mov edx, 2
mul edx
mov edi, esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f48f1
add esp, 4
mov esi, eax
test edi, edi
je 0x45ceb2
push edi
call fcn.004f48c9
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
setne bl
test esi, esi
je 0x45cedf
push esi
call fcn.004f48c9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45ee00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x584920
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x60c4e8]
push edi
mov edi, ecx
test eax, eax
jne 0x45efd7
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x34], al
lea eax, [ebp - 0xf]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x41753040
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 0x58763866
push eax
push eax
mov ecx, eax
mov dword [ebp - 0x14], 0x7535646c
mov byte [ebp - 0x10], 0x35
mov dword [ebp - 0x20], 0xf
call fcn.0045c840
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0045b370
cmp dword [eax + 0x14], 0x10
jb 0x45ee82
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x10
jb 0x45eea1
inc eax
lea ecx, [ebp - 0x64]
push eax
push dword [ebp - 0x64]
call fcn.0040c0a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x64], 0
cmp eax, 0x10
jb 0x45eecf
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.0040c0a0
movaps xmm0, xmmword [0x5c8e60]
lea eax, [ebp - 0x7f]
push eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x20], 0xf
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0xa4], xmm0
mov ecx, eax
mov byte [ebp - 0x34], 0
movaps xmm0, xmmword [0x5c8ec0]
push eax
push eax
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0x84], 0x3d674258
mov byte [ebp - 0x80], 0x3d
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
call fcn.0045c840
lea edx, [ebp - 0x4c]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x7c]
call fcn.0045b370
cmp dword [eax + 0x14], 0x10
jb 0x45ef4e
mov eax, dword [eax]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x68]
mov dword [0x60c4e8], eax
pop esi
cmp ecx, 0x10
jb 0x45ef78
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x7c]
call fcn.0040c0a0
mov eax, dword [0x60c4e8]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x7c], 0
cmp ecx, 0x10
jb 0x45efad
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x4c]
call fcn.0040c0a0
mov eax, dword [0x60c4e8]
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
test eax, eax
jne 0x45efd7
mov eax, 1
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1b
push edi
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x467430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x467461
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x467450
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x469340
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x469509
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x469509
cmp eax, 0x29
jne 0x469379
cmp dword [esi + 0x10], 0
jne 0x469509
test dword [esi + 0x50], 0x10000000
je 0x46950f
cmp eax, 0x2e
jne 0x4693d0
push 5
lea ecx, [esi + 0x24]
call fcn.004696f0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4693c4
cmp byte [eax], 0x5c
jne 0x4693c2
inc eax
cmp eax, ecx
je 0x4693c2
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4693af
mov dl, byte [eax]
cmp dl, 0x28
je 0x4693c0
cmp dl, 0x29
je 0x4693c0
test cl, 0x10
jne 0x4693c2
mov cl, byte [eax]
cmp cl, 0x7b
je 0x4693c0
cmp cl, 0x7d
jne 0x4693c2
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00468790
jmp 0x4694f6
cmp eax, 0x5c
jne 0x469435
mov ecx, esi
call fcn.004692f0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x469402
cmp byte [esi + 0x48], 0x62
jne 0x469402
push 4
lea ecx, [esi + 0x24]
call fcn.004696f0
mov ecx, esi
call fcn.004692f0
jmp 0x4694fd
test eax, eax
je 0x469429
cmp byte [esi + 0x48], 0x42
jne 0x469429
push 4
lea ecx, [esi + 0x24]
call fcn.004696f0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004692f0
jmp 0x4694fd
mov ecx, esi
call fcn.0046a0c0
jmp 0x4694f6
cmp eax, 0x5b
jne 0x469458
mov ecx, esi
call fcn.004692f0
mov ecx, esi
call fcn.0046a030
push 4
push 0x5d
mov ecx, esi
call fcn.00469fd0
jmp 0x4694f6
cmp eax, 0x28
jne 0x469482
mov ecx, esi
call fcn.004692f0
mov ecx, esi
call fcn.0046a180
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00469fd0
test bl, bl
je 0x4694fd
jmp 0x4694f6
cmp eax, 0x5e
jne 0x46949a
push 2
lea ecx, [esi + 0x24]
call fcn.004696f0
mov ecx, esi
call fcn.004692f0
jmp 0x4694fd
cmp eax, 0x24
jne 0x4694b2
push 3
lea ecx, [esi + 0x24]
call fcn.004696f0
mov ecx, esi
call fcn.004692f0
jmp 0x4694fd
cmp eax, 0x2a
je 0x469524
cmp eax, 0x2b
je 0x469524
cmp eax, 0x3f
je 0x469524
cmp eax, 0x7b
je 0x469524
cmp eax, 0x7d
jne 0x4694d4
test dword [esi + 0x50], 0x10000000
je 0x469516
cmp eax, 0x5d
jne 0x4694e2
test dword [esi + 0x50], 0x10000000
je 0x46951d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0046a370
mov ecx, esi
call fcn.004692f0
mov ecx, esi
call fcn.0046a240
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x469351
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.004bd1f6
push 6
call fcn.004bd1f6
push 4
call fcn.004bd1f6
push 0xa
call fcn.004bd1f6
int3
Function at 0x475940
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov ebx, 4
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov cl, byte [edx + 0xd]
mov byte [eax], cl
mov cl, byte [edx + 0xe]
mov byte [esi + 0xe], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
nop word [eax + eax]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov ch, byte [eax + 2]
mov dh, byte [eax - 1]
mov byte [ebp - 3], cl
mov byte [ebp - 1], dl
mov byte [ebp - 2], ch
test bl, 3
jne 0x475a1b
movzx ecx, cl
mov dl, dh
mov dh, byte [ecx + str.cw]
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, dl
mov dl, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
xor dh, byte [ecx + 0x5bc2c4]
mov ch, byte [ebp - 2]
mov cl, byte [eax - 0xd]
inc ebx
xor cl, dh
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, byte [ebp - 3]
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dl
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, ch
mov byte [eax + 6], cl
add eax, 4
cmp ebx, 0x2c
jb 0x4759c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ecx + 2]
mov esi, 4
nop
mov dl, byte [eax + 1]
lea eax, [eax + 4]
mov bh, byte [eax - 4]
mov dh, dl
mov cl, byte [eax - 6]
xor dh, bh
mov bl, byte [eax - 5]
mov byte [ebp - 2], cl
mov byte [ebp - 3], dl
mov dl, dh
xor dl, cl
xor dl, bl
mov byte [ebp - 1], dl
mov dl, cl
xor dl, bl
mov cl, dl
add dl, dl
shr cl, 7
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, bl
xor cl, byte [ebp - 2]
xor dl, bh
xor cl, byte [ebp - 1]
mov byte [eax - 6], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, byte [ebp - 3]
xor cl, bl
xor dl, byte [ebp - 2]
mov bl, byte [ebp - 1]
xor cl, bl
mov byte [eax - 5], cl
mov cl, dh
shr cl, 7
add dh, dh
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dh
xor cl, bh
xor cl, bl
mov byte [eax - 4], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
xor cl, byte [ebp - 3]
xor cl, bl
mov byte [eax - 3], cl
sub esi, 1
jne 0x475a60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475d00
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 0xc], eax
sub edx, edi
mov esi, edi
mov ebx, 4
nop dword [eax]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x475d25
sub ebx, 1
jne 0x475d20
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov dword [ebp - 8], 9
mov ebx, edi
mov dword [ebp - 4], 4
nop dword [eax + eax]
mov ecx, ebx
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
sub edx, 1
jne 0x475d60
inc ebx
sub dword [ebp - 4], 1
jne 0x475d50
mov cl, byte [edi + 1]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, edi
mov byte [edi + 0xb], al
call fcn.00475a50
mov eax, edi
mov ebx, 4
nop dword [eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x475de5
sub ebx, 1
jne 0x475de0
sub dword [ebp - 8], 1
jne 0x475d42
mov esi, edi
lea ebx, [edx + 4]
mov ecx, esi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
sub edx, 1
jne 0x475e10
inc esi
sub ebx, 1
jne 0x475e04
mov cl, byte [edi + 1]
lea esi, [edx + 4]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xb], al
add ecx, 0xa0
mov edx, 4
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
sub edx, 1
jne 0x475e90
sub esi, 1
jne 0x475e86
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475eb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xa0]
nop dword [eax + eax]
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x475ed5
sub ebx, 1
jne 0x475ed0
mov eax, dword [ebp - 8]
add eax, 0x90
mov byte [ebp - 1], 9
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5bc3d0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x475f60
inc edi
sub ebx, 1
jne 0x475f50
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x475f90
sub ebx, 1
jne 0x475f84
mov ecx, esi
call fcn.00475b00
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x475ef4
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5bc3d0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x476020
inc edi
sub ebx, 1
jne 0x476012
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x476050
sub dword [ebp - 0xc], 1
jne 0x476044
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], eax
add eax, 0xb0
mov dword [ebp - 8], eax
mov esi, eax
push edi
mov edi, edx
test ebx, ebx
je 0x4760c5
dec ebx
shr ebx, 4
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x4760a0
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.00475d00
mov esi, edi
add edi, 0x10
sub ebx, 1
jne 0x476096
mov eax, dword [ebp - 8]
movups xmm0, xmmword [esi]
pop edi
pop esi
movups xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4760e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, edx
test ebx, ebx
je 0x47612f
push edi
dec ebx
lea edi, [ecx + 0xb0]
shr ebx, 4
sub edi, esi
inc ebx
movups xmm0, xmmword [esi]
mov edx, ecx
mov ecx, esi
call fcn.00475eb0
mov ecx, 0x10
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x476111
mov ecx, dword [ebp - 4]
sub edi, 0x10
movups xmmword [ecx + 0xb0], xmm0
sub ebx, 1
jne 0x476100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
push ebx
push esi
shl eax, 4
xor ebx, ebx
push edi
mov dword [ebp - 4], ecx
add eax, ecx
mov dword [ebp + 8], 4
nop dword [eax]
xor esi, esi
lea edi, [esi + 4]
mov edx, dword [ecx + 0xf4]
lea esi, [esi + 4]
mov cl, byte [eax]
add edx, ebx
inc eax
xor byte [edx + esi - 4], cl
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x476245
inc ebx
sub dword [ebp + 8], 1
jne 0x476240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x476270
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
push ebx
push esi
shl eax, 4
xor ebx, ebx
push edi
mov dword [ebp - 4], ecx
add eax, ecx
mov dword [ebp + 8], 4
nop dword [eax]
xor esi, esi
lea edi, [esi + 4]
mov edx, dword [ecx + 0xf4]
lea esi, [esi + 1]
mov cl, byte [eax]
add edx, ebx
inc eax
xor byte [edx + esi - 1], cl
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x476295
add ebx, 4
sub dword [ebp + 8], 1
jne 0x476290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4762d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0xf0
mov esi, ecx
push 0
push esi
call fcn.005065b0
mov eax, dword [esi + 0xf0]
add esp, 0xc
movzx eax, byte [eax]
mov byte [esi], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 1]
mov byte [esi + 1], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 2]
mov byte [esi + 2], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 3]
mov byte [esi + 3], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 4]
mov byte [esi + 4], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 5]
mov byte [esi + 5], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 6]
mov byte [esi + 6], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 7]
mov byte [esi + 7], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 8]
mov byte [esi + 8], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 9]
mov byte [esi + 9], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 0xa]
mov byte [esi + 0xa], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 0xb]
mov byte [esi + 0xb], al
mov eax, dword [esi + 0xf0]
movzx eax, byte [eax + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov ecx, dword [esi + 0xf0]
movzx ecx, byte [ecx + 0xd]
mov byte [eax], cl
mov ecx, dword [esi + 0xf0]
movzx ecx, byte [ecx + 0xe]
mov byte [esi + 0xe], cl
mov ecx, dword [esi + 0xf0]
movzx ecx, byte [ecx + 0xf]
mov byte [esi + 0xf], cl
mov ecx, 4
pop esi
mov dword [ebp - 8], ecx
push ebx
mov dl, byte [eax + 2]
mov bl, byte [eax - 1]
mov dh, byte [eax]
mov bh, byte [eax + 1]
mov byte [ebp - 1], dl
test cl, 3
jne 0x476409
movzx ecx, dh
mov dl, bl
mov bl, byte [ecx + 0x5bc4d0]
movzx ecx, bh
mov dh, byte [ecx + 0x5bc4d0]
movzx ecx, byte [ebp - 1]
mov bh, byte [ecx + 0x5bc4d0]
movzx ecx, dl
mov dl, byte [ecx + 0x5bc4d0]
mov ecx, dword [ebp - 8]
shr ecx, 2
xor bl, byte [ecx + 0x5bc6d0]
movzx ecx, byte [eax - 0xd]
xor cl, bl
mov byte [eax + 3], cl
movzx ecx, byte [eax - 0xc]
xor cl, dh
mov byte [eax + 4], cl
movzx ecx, byte [eax - 0xb]
xor cl, bh
mov byte [eax + 5], cl
movzx ecx, byte [eax - 0xa]
xor cl, dl
mov byte [eax + 6], cl
add eax, 4
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x2c
jb 0x4763c3
pop ebx
mov esp, ebp
pop ebp
ret