joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e2bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c90
xor eax, eax
push ebp
push 0x47e3d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffffd
mov eax, dword [ebp - 4]
call fcn.00404aa0
dec eax
jle 0x47e3be
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x47e3be
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
call fcn.00402bb4
add al, 0xbf
sub al, 0x1a
jae 0x47e3be
mov eax, dword [ebp - 4]
call fcn.00404ca0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x47e3be
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
call fcn.00402bb4
movzx esi, al
sub esi, 0x41
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
push 0x47e3e8
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47e3be
push 0x47e3f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov dword [0x4ac4b4], edi
test edi, edi
je 0x47e3b5
xor eax, eax
push ebp
push 0x47e3ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0xffff
push esi
push ebx
call dword [0x4ac4b4]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e3b5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e3db
lea eax, [ebp - 4]
call fcn.004047e0
ret
Function at 0x47f834
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x47fa03
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x47f9c5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.00402760
mov dword [ebp - 0x10], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004095b8
mov edx, dword [ebp - 0x10]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00409560
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x5a4d
je 0x47f8b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404298
jmp 0x47fa0a
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
je 0x47f8d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404298
jmp 0x47fa0a
lea ebx, [edi + 0xf8]
movzx esi, word [edi + 6]
dec esi
test esi, esi
jl 0x47f939
inc esi
mov edx, 0x47fa14
mov eax, ebx
call fcn.00409c30
test eax, eax
jne 0x47f933
lea eax, [edi + 0x78]
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
add eax, dword [ebp - 0x10]
call fcn.0047f7e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x47f925
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404298
jmp 0x47fa0a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebx + 0xc]
add eax, dword [ebx + 0x14]
mov dword [ebp - 0x1c], eax
jmp 0x47f939
add ebx, 0x28
dec esi
jne 0x47f8e5
mov dl, 1
mov eax, dword [0x417e20]
call fcn.004039b0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bd]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x47f9b4
cmp eax, 0x2fe
jne 0x47f9b4
xor ecx, ecx
mov edx, 0x16
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov ebx, dword [ebp - 0x10]
mov edx, ebx
mov ecx, 0x2e8
mov eax, dword [ebp - 0x14]
call fcn.0041c6c4
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004095c4
mov edx, ebx
mov ecx, 0x2e8
mov eax, dword [ebp - 8]
call fcn.0040958c
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47f9bb
mov dword [ebp - 0xc], 0xfffffff4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f9d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fa0a
mov eax, dword [ebp - 0x10]
call fcn.00402780
mov eax, dword [ebp - 0x14]
call fcn.004039e0
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004095b8
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480648
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4806e2
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x4ac4b8]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x4ac4b8]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x4ac4b8]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x4ac4b8]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x480667
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4806f8
dec edx
je 0x48072d
jmp 0x48077e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4ac4b8]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x4ac4b8]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x48077e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4ac4b8]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x4ac4b8]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x4ac4b8]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4807e0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4807ff
add edx, 3
sar edx, 2
test edx, edx
jle 0x48090d
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x480834
je 0x480877
sub ecx, 0x2b
je 0x48086d
sub ecx, 4
je 0x480872
dec ecx
sub ecx, 0xa
jb 0x48085f
jmp 0x48087a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x480846
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x480851
jmp 0x48087a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x48087a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x48087a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x48087a
mov byte [eax], 0x3e
jmp 0x48087a
mov byte [eax], 0x3f
jmp 0x48087a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x480817
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4808cb
cmp byte [esp + 7], 0xff
jne 0x4808cb
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x480902
cmp dl, 0xff
je 0x480902
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x48080e
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x481410
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x481431
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x48141e
pop edi
pop esi
pop ebx
ret

Function at 0x482338
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x48238c
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x4ae6f8]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x4aeaf8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x4aeef8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x4af2f8]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x482346
pop edi
pop esi
pop ebx
ret
Function at 0x486e9c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x486f43
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00404ca0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x486f2d
lea eax, [ebp - 4]
mov edx, edi
call fcn.00404e2c
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00404ca0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x486f2d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x486f54
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x486f2d
cmp dword [ebp - 0xc], 0x34
jne 0x486f2d
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486f4a
lea eax, [ebp - 4]
call fcn.004047e0
ret

Function at 0x487464
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x4874e0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4874d1
xor edx, edx
push ebp
push 0x4874ca
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4874f0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4874ad
push ebx
call eax
mov byte [ebp - 1], 1
jmp 0x4874b3
push ebx
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4874d7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x487528
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4876e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403178
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4afcfc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4afd00], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4afd04], eax
mov eax, dword [0x4b0b9c]
cmp dword [eax], 2
sete byte [0x4af8dc]
push 0x4876f4
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00486e6c
cmp byte [0x4af8dc], 0
jne 0x4875b4
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00486e9c
test al, al
je 0x4875b4
mov eax, dword [ebp - 0x4c]
mov dword [0x4b2234], eax
jmp 0x4875bb
xor eax, eax
mov dword [0x4b2234], eax
call fcn.00487268
and eax, 0x7f
cmp eax, 0x10
ja case.0x4875cc.0
jmp dword [eax*4 + 0x4875d3]
mov byte [0x4af8c8], 1
jmp case.0x4875cc.0
mov byte [0x4af8cc], 1
jmp case.0x4875cc.0
mov byte [0x4af8d0], 1
jmp case.0x4875cc.0
mov byte [0x4af8d4], 1
jmp case.0x4875cc.0
mov byte [0x4af8d8], 1
jmp case.0x4875cc.0
mov byte [0x4af8e0], 1
mov byte [0x4af8e4], 1
jmp case.0x4875cc.0
mov byte [0x4af8e0], 1
mov byte [0x4af8e8], 1
jmp case.0x4875cc.0
mov byte [0x4af8e0], 1
mov byte [0x4af8e8], 1
mov byte [0x4af8ec], 1
jmp case.0x4875cc.0
mov byte [0x4af8f0], 1
jmp case.0x4875cc.0
mov byte [0x4af8f4], 1
jmp case.0x4875cc.0
mov byte [0x4af8f8], 1
jmp case.0x4875cc.0
mov byte [0x4af8fc], 1
jmp case.0x4875cc.0
mov byte [0x4af900], 1
jmp case.0x4875cc.0
mov byte [0x4af904], 1
jmp case.0x4875cc.0
mov byte [0x4af908], 1
jmp case.0x4875cc.0
mov byte [0x4af90c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4876ef
lea eax, [ebp - 4]
call fcn.004047e0
ret

Function at 0x4881fc
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
mov eax, ebx
call fcn.00404ca0
push eax
push 0x48821c
push 0
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x48be70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x48be79
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48c02b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048c1b8
xor eax, eax
push ebp
push 0x48c009
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x48bec8
call fcn.00404298
jmp 0x48c010
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x48bf97
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x48bf1d
mov eax, dword [ebp - 4]
cmp word [eax + 0x34], 0
je 0x48bf1d
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0048be24
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x47]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b60
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x36]
call dword [edi + 0x32]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x48bf56
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0048be24
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x47]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b60
mov eax, dword [ebp - 0x14]
call fcn.00404ca0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x48bff3
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0048be24
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
push dword [eax + 0x47]
push ebx
push 0x48c044
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404b60
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0048be44
jmp 0x48bff3
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x48bfba
mov eax, dword [ebp - 4]
cmp word [eax + 0x34], 0
je 0x48bfba
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x36]
call dword [edi + 0x32]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x48bfd0
mov eax, ebx
call fcn.00404ca0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x48bff3
lea eax, [ebp - 0x24]
mov ecx, 0x48c044
mov edx, ebx
call fcn.00404aec
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0048be44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c010
mov eax, dword [ebp - 4]
call fcn.0048c1c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c032
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404804
ret

Function at 0x496c60
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004977ac
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4976f0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, ecx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x49772c
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x497732
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x497711
lea eax, [ebp - 0x60]
call fcn.00496c60
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00496c88
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004975fc
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00496d5c
lea eax, [ebp - 0x60]
call fcn.00496c60
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00496c88
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.00496c88
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00496d5c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x497b4c
Capabilities:
Hash data using sha1

Disassembly:
test eax, eax
jne 0x497b56
mov eax, 1
ret
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x60], edx
xor edx, edx
mov dword [eax + 0x64], edx
xor eax, eax
ret

Function at 0x497ce8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff0c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x49]
xor ecx, ecx
mov edx, 0x41
call fcn.00403178
lea eax, [ebp - 0x8a]
xor ecx, ecx
mov edx, 0x41
call fcn.00403178
cmp ebx, 0x40
jle 0x497d71
lea eax, [ebp - 0xf4]
call fcn.00497b4c
mov edx, esi
lea eax, [ebp - 0xf4]
mov ecx, ebx
call fcn.00497c04
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.00497b94
lea edx, [ebp - 0x49]
mov eax, dword [ebp + 8]
mov ecx, 0x14
call fcn.004029d4
lea edx, [ebp - 0x8a]
mov eax, dword [ebp + 8]
mov ecx, 0x14
call fcn.004029d4
jmp 0x497d8c
lea edx, [ebp - 0x49]
mov eax, esi
mov ecx, ebx
call fcn.004029d4
lea edx, [ebp - 0x8a]
mov eax, esi
mov ecx, ebx
call fcn.004029d4
mov ecx, 0x40
lea eax, [ebp - 0x49]
lea edx, [ebp - 0x8a]
xor byte [eax], 0x36
xor byte [edx], 0x5c
inc edx
inc eax
dec ecx
jne 0x497d9a
lea eax, [ebp - 0xf4]
call fcn.00497b4c
lea edx, [ebp - 0x49]
lea eax, [ebp - 0xf4]
mov ecx, 0x40
call fcn.00497c04
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xf4]
mov ecx, dword [ebp - 8]
call fcn.00497c04
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.00497b94
lea eax, [ebp - 0xf4]
call fcn.00497b4c
lea edx, [ebp - 0x8a]
lea eax, [ebp - 0xf4]
mov ecx, 0x40
call fcn.00497c04
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
mov ecx, 0x14
call fcn.00497c04
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.00497b94
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x497f08
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x4b0024
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x497f27
mov esi, 1
mov edx, 0x4b012c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x497fa0
dec ebx
je 0x497fc2
dec ebx
je 0x497fe4
dec ebx
je 0x498005
jmp 0x49801f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x49801f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x49801f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x49801f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x497f90
inc esi
add edx, 0x40
cmp esi, 9
jne 0x497f43
mov esi, 0x20
mov eax, 0x4b0054
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x498044
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x498080
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x4b00db]
test bl, bl
jbe 0x4980b1
lea eax, [esi + 0x3e0]
call fcn.0049805c
lea eax, [esi + 0x3fc]
call fcn.0049805c
dec bl
jne 0x498097
mov cl, 0x30
mov edi, 0x4b00ac
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4980d2
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4980df
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4980bb
pop edx
pop edi
pop esi
pop ebx
ret