joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4692b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0049043a
add esp, 8
test eax, eax
jne 0x4692e7
mov eax, 1
jmp 0x4693fb
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004a6fb9
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.004a734e
lea ecx, [ebp - 0x14]
call fcn.00402dc0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov edx, 1
test edx, edx
je 0x4693d6
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.004a7420
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x469349
jmp 0x4693d6
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049f7ba
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x14]
call fcn.004a7084
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004a6f4b
push 0
lea ecx, [ebp - 0x14]
call fcn.00430bb0
push eax
call fcn.0049043a
add esp, 8
test eax, eax
je 0x4693d1
push 0
lea ecx, [ebp - 0x14]
call fcn.00430bb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4693d1
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004a6f4b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a6f4b
mov eax, dword [ebp - 0x20]
jmp 0x4693fb
jmp 0x469317
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004a6f4b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a6f4b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x470087
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x44], ecx
mov dword [0x50bd54], 0x20
lea ecx, [ebp - 0x20]
call fcn.004204a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x44]
call fcn.0046fc3c
push 0x50bd58
push 0x50bd54
push 0x50bd34
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.0046f27e
test eax, eax
je 0x47010f
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00420620
mov eax, dword [ebp - 0x3c]
jmp 0x4701b4
mov byte [ebp - 0x38], 0xaa
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0x71
mov byte [ebp - 0x35], 0xf2
mov byte [ebp - 0x34], 0x71
mov byte [ebp - 0x33], 0xde
mov byte [ebp - 0x32], 9
mov byte [ebp - 0x31], 0xa9
mov byte [ebp - 0x30], 0xef
mov byte [ebp - 0x2f], 0x75
mov byte [ebp - 0x2e], 0x50
mov byte [ebp - 0x2d], 0xed
mov byte [ebp - 0x2c], 0x3a
mov byte [ebp - 0x2b], 0xd1
mov byte [ebp - 0x2a], 0xc6
mov byte [ebp - 0x29], 0x2d
mov byte [ebp - 0x28], 0x9e
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0x89
mov byte [ebp - 0x25], 0xde
mov byte [ebp - 0x24], 0x19
mov byte [ebp - 0x23], 0xa6
mov byte [ebp - 0x22], 0x71
mov byte [ebp - 0x21], 0x2c
mov dword [0x50bd54], 0x18
mov dword [0x50bd58], 3
mov ecx, dword [0x50bd54]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0x50bd34
call fcn.0048f2e0
add esp, 0xc
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00420620
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4709d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov cl, byte [eax + 0x104]
mov byte [ebp - 8], cl
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + 0x105]
mov byte [ebp - 0xc], al
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
jmp 0x470a0e
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x470b0f
mov ecx, dword [ebp - 8]
and ecx, 0xff
add ecx, 1
and ecx, 0x800000ff
jns 0x470a36
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 8], cl
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
mov edx, dword [ebp - 0xc]
and edx, 0xff
add ecx, edx
and ecx, 0x800000ff
jns 0x470a65
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 8]
and eax, 0xff
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx + eax]
mov byte [ebp - 4], dl
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov cl, byte [esi + ecx]
mov byte [eax + edx], cl
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov bl, byte [eax + edx]
add ecx, ebx
and ecx, 0x800000ff
jns 0x470ae8
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0x18], cl
mov ecx, dword [ebp - 0x18]
and ecx, 0xff
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dl, byte [edx]
xor dl, byte [eax + ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov byte [eax], dl
jmp 0x470a05
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 8]
mov byte [ecx + 0x104], dl
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0x105], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x471c96
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d48c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0043f580
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004735e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00402dc0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.0040b050
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4dfeb8
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x4dfe90
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0x4dfe88
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0x4dfe6c
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0x3f800000
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0x190
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0x258
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x471d8f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d48da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x4dfeb8
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], 0x4dfe90
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], 0x4dfe88
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc], 0x4dfe6c
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x471e12
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x471e0b
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
call dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
jmp 0x471e12
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.004a6f4b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47280a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a6ed6
push 0x104
lea eax, [ebp - 0x124]
push eax
call sub.CRCommon.dll_g_GetCurrentUserDataPath
add esp, 8
cmp eax, 0xffffffff
jne 0x472854
jmp 0x472a4d
push str.Data
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [ebp - 0x124]
push edx
call fcn.0049043a
add esp, 8
test eax, eax
je 0x47288a
push 0
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004a6fb9
mov dword [ebp - 4], 0
push str._:__
push 0x50476c
lea ecx, [ebp - 0x1c]
call fcn.0049f4d1
push 0x504770
push 0x504774
lea ecx, [ebp - 0x1c]
call fcn.0049f4d1
lea ecx, [ebp - 0x1c]
call fcn.00402de0
mov dword [ebp - 0x14], eax
push 0x5c
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x128]
call fcn.004a6fb9
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x140]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0049f300
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x128]
call fcn.004a6f4b
lea ecx, [ebp - 0x18]
call fcn.00402de0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004a717a
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
cmp eax, 0xfa
jle 0x4729dd
mov ecx, 0x104
sub ecx, dword [ebp - 0x20]
sub ecx, 0xa
push ecx
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0049f73e
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004a7084
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12c]
call fcn.004a6f4b
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x130]
push ecx
call fcn.004a717a
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
mov dword [ebp - 0x150], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0x10]
call fcn.004a7084
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x130]
call fcn.004a6f4b
push 0x504778
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.004a71e0
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x158]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a7084
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x134]
call fcn.004a6f4b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.004a6f4b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004a6f4b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004a6f4b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x474904
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4d4a86
call fcn.004909c4
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
and esi, 0xf00
mov dword [ebp - 0x10], esp
je 0x474943
cmp esi, 0x200
je 0x474943
cmp esi, 0x100
je 0x474943
cmp esi, 0x300
je 0x474943
push 1
jmp 0x474af9
push 0x8000
push dword [ebp + 8]
call fcn.00490d96
pop ecx
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0x1c], eax
jne 0x474961
push 3
jmp 0x474af9
test esi, esi
je 0x4749af
cmp esi, 0x100
je 0x474993
cmp esi, 0x200
jne 0x4749d3
push 0x24
call fcn.004a7fba
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x4749cb
call fcn.0047d48e
mov esi, eax
jmp 0x4749cd
push 0x24
call fcn.004a7fba
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 3
je 0x4749cb
call fcn.0047cadd
jmp 0x47498f
push 0x24
call fcn.004a7fba
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 1
je 0x4749cb
call fcn.0047b0c4
jmp 0x47498f
xor esi, esi
and byte [ebp - 4], 0
jmp 0x4749d6
mov esi, dword [ebp + 0x1c]
test esi, esi
jne 0x4749e2
push 5
pop esi
jmp 0x474ae4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
call fcn.0048f97e
test eax, eax
pop ecx
mov dword [ebp + 8], eax
jne 0x474a0f
push dword [ebp + 0x1c]
call fcn.00490cb6
mov eax, dword [esi]
pop ecx
push 1
mov ecx, esi
call dword [eax]
push 5
jmp 0x474af9
mov ebx, 0x2800
push ebx
call fcn.0048f97e
mov edi, eax
pop ecx
test edi, edi
jne 0x474a66
mov ebx, 0x200
push ebx
call fcn.0048f97e
mov edi, eax
pop ecx
test edi, edi
jne 0x474a66
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push eax
call fcn.0048f97e
pop ecx
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test edi, edi
mov ebx, eax
jne 0x474a66
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [ebp + 8]
call fcn.0048f1f0
pop ecx
jmp 0x4749da
push dword [ebp + 0x1c]
call fcn.00490c21
test eax, eax
pop ecx
jne 0x474ab3
push ebx
push edi
push dword [ebp + 0x1c]
call fcn.004909e3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x474aa8
push edi
call fcn.0048f1f0
test esi, esi
pop ecx
je 0x474a98
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [ebp + 8]
call fcn.0048f1f0
pop ecx
push 4
jmp 0x4749dc
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 4]
jmp 0x474a66
mov ebx, dword [ebp + 8]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 8]
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [eax], ebx
mov eax, dword [esi]
call dword [eax + 0xc]
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ecx], eax
call fcn.0048f1f0
test esi, esi
pop ecx
je 0x474ae2
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
xor esi, esi
push dword [ebp + 0x1c]
call fcn.00490cb6
pop ecx
mov eax, esi
jmp 0x474afa
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x18
Function at 0x479877
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4eed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax + 4], 0xffffffff
je 0x4798de
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0x18]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 0x4c]
lea ecx, [ebp - 0x10]
call fcn.00430bb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004a6f4b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.0047ab10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.004a8206
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47b11f
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
lea eax, [ecx + 0x20]
mov ecx, dword [ecx + 0x20]
mov dword [ecx], 0x67452301
mov ecx, dword [eax]
mov dword [ecx + 4], 0xefcdab89
mov ecx, dword [eax]
mov dword [ecx + 8], 0x98badcfe
mov ecx, dword [eax]
mov dword [ecx + 0xc], 0x10325476
mov eax, dword [eax]
mov dword [eax + 0x10], 0xc3d2e1f0
ret

Function at 0x47d4c8
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
lea eax, [ecx + 0x20]
mov ecx, dword [ecx + 0x20]
mov dword [ecx], 0x67452301
mov ecx, dword [eax]
mov dword [ecx + 4], 0xefcdab89
mov ecx, dword [eax]
mov dword [ecx + 8], 0x98badcfe
mov eax, dword [eax]
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4812bd
Capabilities:
Encrypt data using rc6

Disassembly:
mov eax, 0x4d539f
call fcn.004909c4
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x4e00c0
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov dword [esi + 4], eax
lea eax, [eax + eax + 2]
mov dword [esi + 8], eax
shl eax, 2
push eax
call fcn.004a7fba
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], 0x4e039c
lea edi, [eax + 3]
shr edi, 2
mov ebx, edi
mov dword [ebp - 0x1c], edi
shl ebx, 2
push ebx
call fcn.004a7fba
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push eax
call fcn.0048f2e0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ebx, eax
add ecx, eax
push ebx
xor ebx, ebx
push ebx
push ecx
call fcn.00490070
mov eax, dword [esi + 0xc]
add esp, 0x20
push 1
mov dword [eax], 0xb7e15163
pop eax
cmp dword [esi + 8], eax
jbe 0x481368
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + eax*4 - 4]
lea ecx, [ecx + eax*4]
sub edx, 0x61c88647
inc eax
mov dword [ecx], edx
cmp eax, dword [esi + 8]
jb 0x481350
mov eax, dword [esi + 8]
mov dword [ebp + 0x10], ebx
cmp eax, edi
ja 0x481374
mov eax, edi
lea eax, [eax + eax*2]
mov dword [ebp + 0xc], ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jbe 0x4813e0
mov eax, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0x20
lea ecx, [eax + edx*4]
mov eax, dword [eax + edx*4]
add eax, ebx
add eax, dword [ebp + 0x10]
mov edx, eax
shr edx, 0x1d
shl eax, 3
or edx, eax
mov eax, dword [ebp + 0xc]
mov dword [ecx], edx
mov ecx, edx
xor edx, edx
mov dword [ebp + 0x10], ecx
div edi
mov eax, dword [ebp - 0x18]
lea edx, [eax + edx*4]
mov eax, dword [edx]
add eax, ebx
add ebx, ecx
add eax, ecx
and ebx, 0x1f
pop ecx
mov dword [ebp + 8], ebx
sub ecx, ebx
mov ebx, eax
shr ebx, cl
mov ecx, dword [ebp + 8]
shl eax, cl
or ebx, eax
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [edx], ebx
cmp eax, dword [ebp - 0x10]
jb 0x481381
lea ecx, [ebp - 0x1c]
call fcn.0047664f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x481417
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
mov eax, dword [edi]
mov esi, dword [edi + 4]
add eax, dword [edx]
add esi, dword [edx + 4]
add edi, 8
test ecx, ecx
jbe 0x48147a
push ebx
mov dword [ebp + 8], ecx
mov edx, esi
push 0x20
xor eax, esi
and edx, 0x1f
pop ecx
mov ebx, eax
sub ecx, edx
push 0x20
shr ebx, cl
mov ecx, edx
shl eax, cl
pop ecx
or ebx, eax
add ebx, dword [edi]
add edi, 8
mov eax, ebx
mov edx, eax
xor edx, esi
mov esi, eax
and esi, 0x1f
mov ebx, edx
sub ecx, esi
shr ebx, cl
mov ecx, esi
shl edx, cl
or ebx, edx
add ebx, dword [edi - 4]
dec dword [ebp + 8]
mov esi, ebx
jne 0x48143a
pop ebx
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
pop ebp
ret 8
Function at 0x481488
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 8]
push esi
mov esi, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
push edi
mov dword [ebp - 4], esi
lea edi, [esi + eax*4]
mov eax, dword [ebp + 8]
test ecx, ecx
mov edx, dword [eax]
mov eax, dword [eax + 4]
jbe 0x4814ee
push ebx
mov dword [ebp + 8], ecx
sub eax, dword [edi - 4]
sub edi, 8
mov esi, edx
push 0x20
and esi, 0x1f
pop ecx
sub ecx, esi
mov ebx, eax
shl ebx, cl
mov ecx, esi
push 0x20
shr eax, cl
pop ecx
or ebx, eax
xor ebx, edx
sub edx, dword [edi]
mov eax, ebx
mov esi, eax
mov ebx, edx
and esi, 0x1f
sub ecx, esi
shl ebx, cl
mov ecx, esi
shr edx, cl
or ebx, edx
xor ebx, eax
dec dword [ebp + 8]
mov edx, ebx
jne 0x4814ad
mov esi, dword [ebp - 4]
pop ebx
sub eax, dword [esi + 4]
sub edx, dword [esi]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], edx
mov dword [ecx + 4], eax
leave
ret 8

Function at 0x481cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov ecx, eax
dec eax
test ecx, ecx
je 0x481d01
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea ebx, [eax + 1]
mov ecx, dword [ebp - 4]
call fcn.00476a44
xor al, byte [edi]
mov byte [esi], al
inc esi
inc edi
dec ebx
jne 0x481ced
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x482396
Capabilities:
Encrypt data using des

Disassembly:
mov eax, 0x4d5463
call fcn.004909c4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [esi], 0x4e00c0
and dword [ebp - 4], 0
push 0x80
mov dword [esi + 4], 0x20
call fcn.004a7fba
mov dword [esi + 8], eax
push 0x78
mov byte [ebp - 4], 1
pop eax
mov dword [esi], 0x4e0454
push eax
mov dword [ebp - 0x24], eax
call fcn.004a7fba
and dword [ebp - 0x10], 0
lea ebx, [eax + 0x38]
pop ecx
mov dword [ebp - 0x20], eax
pop ecx
mov dword [ebp - 0x14], eax
lea edi, [ebx + 0x38]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
movzx eax, byte [eax + str.91__]
dec eax
mov ecx, eax
and eax, 7
sar ecx, 3
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x10]
test byte [eax*4 + 0x4e0434], cl
mov ecx, dword [ebp - 0x14]
setne al
inc dword [ebp - 0x10]
mov byte [edx + ecx], al
cmp dword [ebp - 0x10], 0x38
jl 0x4823f1
and dword [ebp + 8], 0
push 8
push 0
push edi
call fcn.00490070
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x4e03f4]
add eax, ecx
cmp ecx, 0x1c
setge dl
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x48245b
add eax, 0xffffffe4
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 0x38
jl 0x482439
xor eax, eax
mov dword [ebp - 0x10], eax
movzx ecx, byte [eax + 0x4e0404]
cmp byte [ecx + ebx - 1], 0
je 0x48249d
push 6
cdq
pop ecx
idiv ecx
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [edx*4 + 0x4e0434]
sar ecx, 2
or byte [eax], cl
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x30
mov dword [ebp - 0x10], eax
jl 0x48246f
movzx edx, byte [edi + 4]
xor ecx, ecx
mov eax, dword [ebp + 8]
mov cl, byte [edi + 2]
mov ch, byte [edi]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 6]
shl ecx, 8
or ecx, edx
mov edx, dword [esi + 8]
shl eax, 3
mov dword [eax + edx], ecx
xor ecx, ecx
mov ch, byte [edi + 1]
mov cl, byte [edi + 3]
movzx edx, byte [edi + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 7]
shl ecx, 8
or ecx, edx
mov edx, dword [esi + 8]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x10
mov dword [eax + edx + 4], ecx
jl 0x48242a
cmp dword [ebp + 0xc], 1
jne 0x482544
push 0x7c
xor edi, edi
pop edx
mov eax, dword [esi + 8]
mov ebx, dword [eax + edi]
lea ecx, [edx + eax - 4]
add eax, edi
mov dword [ebp + 8], ebx
mov ebx, dword [ecx]
mov dword [eax], ebx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
mov ebx, dword [edi + eax + 4]
lea ecx, [edx + eax]
lea eax, [edi + eax + 4]
mov dword [ebp + 8], ebx
mov ebx, dword [ecx]
sub edx, 8
mov dword [eax], ebx
mov eax, dword [ebp + 8]
add edi, 8
cmp edx, 0x3c
mov dword [ecx], eax
jg 0x482507
lea ecx, [ebp - 0x24]
call fcn.00476512
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8