joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x3ff
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x403]
push 0
push eax
mov esi, edx
mov edi, ecx
mov byte [ebp - 0x404], 0
call fcn.005877c0
lea eax, [ebp - 0x404]
push 0x400
push eax
mov dword [ebp - 0x408], 0
call fcn.004019d0
add esp, 0x14
test eax, eax
jne 0x43a84f
call fcn.0058c30d
push dword [eax]
push str.Faile_to_get_temp_directory___d_.
jmp 0x43a951
push 1
push 0x5e0864
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0058b4e8
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43a870
sub ecx, edx
push ecx
push esi
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0058b4e8
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x404]
call fcn.00401900
add esp, 0x14
test eax, eax
je 0x43a945
mov esi, dword [ebp - 0x408]
test esi, esi
je 0x43a945
mov eax, dword [edi + 0x10]
push ebx
xor ebx, ebx
cmp dword [edi + 0x14], 0x10
jb 0x43a8c5
mov edi, dword [edi]
push esi
push 1
push eax
push edi
call fcn.0058a2cd
add esp, 0x10
cmp eax, 1
je 0x43a917
call fcn.0058c30d
push dword [eax]
push str.Faile_to_write_data_in_to_temp_file___d_.
push 2
call fcn.004351b0
push esi
call fcn.005890ae
lea eax, [ebp - 0x404]
push eax
call fcn.00401a70
add esp, 0x14
mov ebx, 0xd
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push eax
call fcn.004080a0
push esi
call fcn.005890ae
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
call fcn.0058c30d
push dword [eax]
push str.Faile_to_create_temporary_file___d_.
push 2
call fcn.004351b0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
mov eax, 0xc
pop esi
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
Function at 0x43f1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
mov ecx, 0x5dc652
sub ecx, edx
push ebx
mov dword [ebp - 4], ecx
push esi
mov ecx, 0x5dc653
sub ecx, edx
push edi
mov dword [ebp - 8], ecx
mov edi, 0x5dc650
mov ebx, 0x5dc651
mov ecx, 0x5dc654
sub edi, edx
sub ebx, edx
sub ecx, edx
mov byte [edx], 0xd3
lea eax, [edx + 1]
mov dword [ebp - 0xc], ecx
mov esi, 0x33
movzx ecx, byte [edi + eax]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 1], cl
dec esi
jne 0x43f202
pop edi
pop esi
mov eax, 0x100
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4432b0
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4432bd
mov eax, dword [esi]
jmp 0x4432bf
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x443306
cmp eax, 0xb7
je 0x443306
cmp eax, 0x50
je 0x443306
cmp dword [esi + 0x14], 8
jb 0x4432e2
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_directoryPath_...Error_Code_is:__d_._At_desired_location:_s
push 0x5ea790
call fcn.00449220
push eax
call fcn.00449f70
add esp, 0x14
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x443310
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba7ee
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x629688]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00443600
test al, al
jne 0x443352
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x44335c
mov eax, dword [esi]
jmp 0x44335e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete bl
test bl, bl
jne 0x4433c7
cmp dword [esi + 0x14], 8
jb 0x443377
mov esi, dword [esi]
mov eax, dword [0x634974]
test al, 1
jne 0x4433a8
or eax, 1
mov dword [0x634974], eax
mov dword [ebp - 4], 0
call fcn.00448ef0
push 0x5c0980
call fcn.00586165
add esp, 4
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_delete_file:__s_LastError:_d
push 0x5ea790
push 0x6348e0
call fcn.0044a000
add esp, 0x14
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba7ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x629688]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x443630
mov eax, dword [esi]
jmp 0x443632
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4436a0
cmp dword [esi + 0x14], 8
jb 0x443645
mov esi, dword [esi]
mov eax, dword [0x634974]
test al, 1
jne 0x443676
or eax, 1
mov dword [0x634974], eax
mov dword [ebp - 4], 0
call fcn.00448ef0
push 0x5c0980
call fcn.00586165
add esp, 4
mov dword [ebp - 4], 0xffffffff
push esi
push str.File__s_does_not_exist
push 0x5ea790
push 0x6348e0
call fcn.00449dc0
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4436c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba88e
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x443751
mov eax, dword [0x634974]
test al, 1
jne 0x443736
or eax, 1
mov dword [0x634974], eax
mov dword [ebp - 4], 0
call fcn.00448ef0
push 0x5c0980
call fcn.00586165
add esp, 4
mov dword [ebp - 4], 0xffffffff
push str.Unable_to_retreive_Local_App_Data_Path_from_Win_library:_n
push 0x5ea790
push 0x6348e0
call fcn.0044a000
add esp, 0xc
xor al, al
jmp 0x443790
cmp word [ebp - 0x218], 0
jne 0x44375f
xor ecx, ecx
jmp 0x44377f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x443770
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x443770
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00408410
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret

Function at 0x4482b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bab20
mov eax, dword fs:[0]
push eax
mov eax, dword [0x629688]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x4482fc
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x4482fe
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x448327
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x448329
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x448ef0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb307
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5ebc04
mov ecx, 0x6348e0
mov dword [ebp - 0x418], 0x6348e0
call fcn.00410350
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push eax
push 0x200
mov dword [0x6348e0], 0x5ebcac
mov dword [0x63496c], 0
mov word [0x634970], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x448f8a
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 8
call fcn.00585fec
mov esi, eax
add esp, 4
test esi, esi
je 0x448fa6
mov dword [esi], 0
mov byte [esi + 4], 0
jmp 0x448fa8
xor esi, esi
mov dword [0x634968], esi
cmp dword [esi], 0
jne 0x448fc6
push str.Local5071F542_DF26_4e46_810E_74570ED35255
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi], eax
push 0xc0
call fcn.00585fec
add esp, 4
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x448feb
push ecx
mov ecx, eax
call fcn.00409760
jmp 0x448fed
xor eax, eax
mov byte [ebp - 4], 0
push 0x1e
mov ecx, eax
mov dword [0x634964], eax
call fcn.00407860
mov ecx, dword [0x634964]
push 0x5e0da4
push str.PDApp.log
call fcn.00407b30
mov eax, dword [0x6348d8]
test al, 1
jne 0x449058
or eax, 1
mov dword [0x6348d8], eax
mov byte [ebp - 4], 2
mov dword [0x6348d0], 0
mov dword [0x6348d4], 0
call fcn.0040f930
push 0x5bfe00
mov dword [0x6348d0], eax
call fcn.00586165
add esp, 4
mov byte [ebp - 4], 0
push dword [0x634964]
mov ecx, 0x6348d0
call fcn.0040ea50
push 3
push 0x5ebc08
mov ecx, 0x634900
call fcn.00408410
mov eax, 0x6348e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
Function at 0x44a120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, edi
shr esi, 2
mov ebx, edx
xor ebp, ebp
mov dword [esp + 0x14], ebx
test esi, esi
je 0x44a1af
cmp esi, 4
jb 0x44a18f
lea eax, [ebx - 4]
lea edx, [ecx - 4]
lea eax, [eax + esi*4]
lea edx, [edx + esi*4]
cmp ecx, eax
ja 0x44a155
cmp edx, ebx
jae 0x44a18f
mov eax, esi
and eax, 3
mov edx, esi
mov edi, ebx
sub edx, eax
sub edi, ecx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov eax, ecx
movdqu xmm1, xmmword [ebx + eax]
movdqu xmm0, xmmword [eax]
add ebp, 4
pxor xmm1, xmm0
movdqu xmmword [eax], xmm1
lea eax, [eax + 0x10]
cmp ebp, edx
jb 0x44a170
mov ebx, dword [esp + 0x14]
cmp ebp, esi
jae 0x44a1af
mov edi, ebx
sub esi, ebp
lea edx, [ecx + ebp*4]
sub edi, ecx
add ebp, esi
mov edi, edi
mov eax, dword [edx + edi]
xor dword [edx], eax
lea edx, [edx + 4]
dec esi
jne 0x44a1a0
mov edi, dword [esp + 0x1c]
shl ebp, 2
sub edi, ebp
je 0x44a1cb
add ecx, ebp
add ebx, ebp
test edi, edi
je 0x44a1cb
sub ebx, ecx
mov al, byte [ecx + ebx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edi
jne 0x44a1c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x44a1e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, edi
mov ebx, edx
xor edx, edx
shr esi, 2
mov ebp, ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], edx
test esi, esi
je 0x44a2de
cmp esi, 4
jb 0x44a29a
lea ecx, [eax - 4]
mov dword [esp + 0x10], edx
lea ecx, [ecx + esi*4]
cmp ebp, ecx
ja 0x44a22b
lea ecx, [ebp - 4]
lea ecx, [ecx + esi*4]
cmp ecx, eax
jae 0x44a29a
lea ecx, [ebx - 4]
lea ecx, [ecx + esi*4]
cmp ebp, ecx
ja 0x44a23f
lea ecx, [ebp - 4]
lea ecx, [ecx + esi*4]
cmp ecx, ebx
jae 0x44a29a
mov edi, ebp
sub edi, ebx
mov dword [esp + 0x14], edi
mov ecx, esi
and ecx, 3
mov dword [esp + 0x10], esi
sub dword [esp + 0x10], ecx
mov edi, eax
mov eax, dword [esp + 0x14]
sub edi, ebx
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov ecx, ebx
lea ebx, [ebx]
movdqu xmm1, xmmword [ecx + ebp]
movdqu xmm0, xmmword [ecx]
add edx, 4
pxor xmm1, xmm0
movdqu xmmword [eax + ecx], xmm1
lea ecx, [ecx + 0x10]
cmp edx, dword [esp + 0x10]
jb 0x44a270
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
cmp edx, esi
jae 0x44a2de
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov edi, ecx
mov ecx, ebp
sub ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x10]
sub esi, ecx
add ecx, esi
lea edx, [eax + edx*4]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
mov ecx, dword [edi + edx]
xor ecx, dword [edx]
lea edx, [edx + 4]
mov dword [eax + edx - 4], ecx
dec esi
jne 0x44a2c3
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
shl edx, 2
sub edi, edx
je 0x44a302
add ebp, edx
add ebx, edx
add eax, edx
test edi, edi
je 0x44a302
sub ebx, eax
sub ebp, eax
mov cl, byte [eax + ebx]
xor cl, byte [eax]
lea eax, [eax + 1]
mov byte [eax + ebp - 1], cl
dec edi
jne 0x44a2f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x44a310
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, esi
shr edi, 2
xor ebx, ebx
xor eax, eax
mov ebp, ecx
test edi, edi
je 0x44a347
mov esi, ebp
mov ecx, edx
sub esi, edx
mov dword [esp + 0x10], edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
or ebx, eax
dec edi
jne 0x44a332
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x44a35b
pop edi
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add edx, eax
mov ecx, ebx
shr ecx, 0x18
mov eax, ebx
shr eax, 0x10
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or cl, bl
test esi, esi
je 0x44a38d
sub ebp, edx
lea ebx, [ebx]
mov al, byte [edx + ebp]
xor al, byte [edx]
lea edx, [edx + 1]
or cl, al
dec esi
jne 0x44a380
pop edi
pop esi
xor eax, eax
test cl, cl
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x4508e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push esi
push edi
lea edx, [eax + 1]
call fcn.0044d680
mov edi, eax
dec ebx
mov dword [ebp + 8], ebx
test edi, edi
je 0x450962
xor esi, esi
test ebx, ebx
jle 0x450955
mov edi, edi
mov eax, dword [ebp - 4]
movsx ebx, byte [eax + esi + 1]
movsx edx, byte [eax + esi]
mov ecx, ebx
sar ecx, 6
and cl, 1
mov al, cl
shl al, 3
sub al, cl
mov ecx, edx
sar ecx, 6
sub bl, al
and cl, 1
mov al, cl
shl al, 3
sub al, cl
sub dl, al
mov ecx, esi
and bl, 0xf
shl dl, 4
shr ecx, 1
xor bl, dl
add esi, 2
mov byte [ecx + edi], bl
cmp esi, dword [ebp + 8]
jl 0x450910
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov byte [eax + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450e50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x450e7d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
movzx edx, byte [eax + 0x5dcd28]
xor edx, ecx
dec edi
xor esi, edx
lea ebx, [ebx + 1]
test edi, edi
jg 0x450e60
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x450f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
lea eax, [esi*8]
cmp eax, 0x400
mov ecx, 0x80
cmova esi, ecx
push edi
mov dword [ebp - 4], ebx
cmp esi, dword [ebx]
jne 0x450f31
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x631990]
test eax, eax
je 0x450f3c
call eax
lea eax, [esi*8]
push eax
call fcn.0044d0b0
mov ecx, dword [0x631994]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x450f5d
call ecx
test esi, esi
je 0x450f28
push dword [ebx + 0xc]
call fcn.0044d3b0
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x62bc10]
shr eax, 3
add esp, 4
lea ecx, [eax*8]
push ecx
push 0
push esi
mov dword [ebp - 8], eax
mov dword [ebx], eax
call fcn.005877c0
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x451040
mov esi, dword [ecx + 0x10]
mov ebx, dword [ecx + 0xc]
xor edi, edi
test esi, esi
jle 0x450fcf
movzx eax, byte [ebx]
dec esi
movzx edx, byte [eax + 0x5dcd28]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
lea ebx, [ebx + 1]
test esi, esi
jg 0x450fb2
xor edx, edx
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ecx]
lea esi, [eax + edx*8]
test esi, esi
je 0x45101a
mov eax, dword [esi]
test eax, eax
je 0x450fed
mov edx, dword [esi + 4]
jmp 0x450fef
xor edx, edx
inc eax
mov dword [esi], eax
mov dword [esi + 4], ecx
test edx, edx
je 0x45101a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x45100f
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x451036
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x451036
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x45102c
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x450fa6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov ecx, dword [ebp + 8]
cmp dword [eax + 0xc], 0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
je 0x4511b4
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov ebx, edx
test ecx, ecx
jle 0x4511a4
movzx eax, byte [ebx]
lea ecx, [esi*8]
movzx edx, byte [eax + 0x5dcd28]
xor edx, ecx
dec edi
xor esi, edx
lea ebx, [ebx + 1]
test edi, edi
jg 0x451184
mov ecx, dword [ebp + 8]
mov eax, esi
mov esi, dword [ebp - 4]
xor edx, edx
div dword [esi]
pop edi
mov eax, esi
pop esi
pop ebx
jmp 0x4511b6
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.00451050
add esp, 8
test eax, eax
je 0x4511d0
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4511e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
mov edi, edx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
je 0x451235
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x451225
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
movzx edx, byte [eax + 0x5dcd28]
xor edx, ecx
dec ebx
xor edi, edx
lea esi, [esi + 1]
test ebx, ebx
jg 0x451205
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x45123a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.00451050
add esp, 8
test eax, eax
je 0x451282
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x451272
push ebx
mov edx, eax
mov ecx, esi
call fcn.00451100
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x451320
push 0x14
call fcn.0044d0b0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4512a6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x4512e6
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x4512e6
add edx, edx
mov ecx, esi
call fcn.00450f00
test eax, eax
je 0x4512e6
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00450e50
xor edx, edx
div dword [esi]
jmp 0x4512e9
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x451307
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.00450e90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x451316
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4846b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov esi, ecx
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
mov ebx, edx
test edx, edx
je 0x4846dd
cmp byte [edx], al
je 0x4846d5
inc ebx
cmp byte [ebx], al
jne 0x4846d0
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x48477f
mov ecx, edi
cmp edi, 2
jge 0x4846f7
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4846fa
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x48474e
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x484730
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5dcd28]
cmp cl, byte [edx + 0x5dcd28]
jne 0x484730
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484713
movzx ecx, byte [esi]
movzx eax, byte [eax]
movzx ecx, byte [ecx + 0x5dcd28]
movzx eax, byte [eax + 0x5dcd28]
mov esi, dword [ebp - 0xc]
sub eax, ecx
jne 0x48476f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00451160
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x48477f
jmp 0x484772
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x4846e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4848a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
test edx, edx
je 0x4848cd
cmp byte [edx], al
je 0x4848c5
jmp 0x4848c0
inc ebx
cmp byte [ebx], al
jne 0x4848c0
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x484973
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x4848ed
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x48494b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x484930
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5dcd28]
cmp cl, byte [edx + 0x5dcd28]
jne 0x48492d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484910
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5dcd28]
movzx ecx, byte [ecx + 0x5dcd28]
sub eax, ecx
jne 0x484960
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.00451160
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x484973
jmp 0x484963
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x4848e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret