joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5eff20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x473deb
je 0x473e3e
cmp ebx, 0x20
jbe 0x473e44
cmp ebx, 0x40
jbe 0x473e8a
jmp 0x473f2b
test ebx, ebx
je 0x473e34
add eax, 0x10
test ax, 0xff0
je 0x473e20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x53b660]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x53b760]
jmp 0x473e08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x473e08
pxor xmm1, xmmword [0x5eff30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5eff30]
pxor xmm2, xmmword [0x5eff40]
pxor xmm3, xmmword [0x5eff50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5eff30]
pxor xmm2, xmmword [0x5eff40]
pxor xmm3, xmmword [0x5eff50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x473f8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5efb88], 0
je 0x47567a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x473db0
jmp fcn.0040a060
Function at 0x475680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4047bc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0040a060
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.004743b0
jmp 0x404780
cmp byte [0x5efb88], 0
je 0x47569b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x473db0
jmp 0x404780

Function at 0x476560
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x47657a
mov ecx, 0x14
jmp 0x476583
shl ecx, 2
add ecx, 0xe10
mov dword [0x5efcb0], ecx
ret
Function at 0x47fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48004c
sub esp, 0x68
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
mov dword [esp + 0x50], 0
jmp 0x47fe76
jmp 0x47fe78
mov eax, dword [esp + 0x6c]
test byte [eax], al
mov dword [esp + 0x60], eax
mov dword [esp], eax
call fcn.00479e20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.0047fc40
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ecx
cmp ecx, eax
je 0x47fecc
jmp 0x47fee5
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
add esp, 0x68
ret
dec eax
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x6c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0047fc80
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x6c]
test byte [eax], al
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00479ec0
movzx eax, byte [esp + 0x14]
mov byte [esp + 0x1b], al
test al, al
jne 0x47ff52
jmp 0x48003f
mov edx, dword [esp + 0x6c]
test byte [edx], al
mov edx, dword [edx + 0xc]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x6c]
test byte [ebx], al
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ebx + 8]
lea eax, [edx - 1]
and eax, dword [esp + 0x30]
cmp ecx, eax
ja 0x47ff7b
jmp 0x480046
lea eax, [ebx + eax*8]
mov dword [esp + 0x50], eax
jmp 0x47ff84
test byte [eax], al
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], 0
lea eax, [0x512360]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0
mov ecx, dword [esp + 0x48]
cmp ecx, eax
je 0x47ffb7
jmp 0x47fff2
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.00405220
movzx eax, byte [esp + 0xc]
test al, al
jne 0x47ffde
jmp 0x47fff0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
jmp 0x47fff4
jmp 0x47fff4
jmp 0x47fff4
mov eax, dword [esp + 0x50]
test byte [eax], al
mov ecx, dword [0x5efdd0]
test ecx, ecx
je 0x480006
jmp 0x480008
jmp 0x480019
mov ecx, dword [eax]
call fcn.004757c0
mov dword [edi], ecx
mov ecx, dword [eax + 4]
mov dword [edi + 4], ecx
jmp 0x480019
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov byte [esp + 0x78], 1
add esp, 0x68
ret
jmp 0x480041
jmp 0x47fe76
call fcn.00475840
nop
call fcn.004743b0
jmp fcn.0047fe40
Function at 0x480060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x480279
sub esp, 0x6c
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov byte [esp + 0x7c], 0
mov dword [esp + 0x50], 0
jmp 0x480096
jmp 0x480098
mov eax, dword [esp + 0x70]
test byte [eax], al
mov dword [esp + 0x64], eax
mov dword [esp], eax
call fcn.00479e20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0047fc40
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ecx
cmp ecx, eax
je 0x4800ec
jmp 0x480105
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov byte [esp + 0x7c], 0
add esp, 0x6c
ret
mov edx, dword [esp + 0x70]
mov dword [esp], edx
mov dword [esp + 4], eax
lea eax, [ecx + 1]
mov dword [esp + 8], eax
call fcn.0047fc80
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x70]
test byte [eax], al
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00479ec0
movzx eax, byte [esp + 0x14]
mov byte [esp + 0x1b], al
test al, al
jne 0x480170
jmp 0x48026c
mov edx, dword [esp + 0x70]
test byte [edx], al
mov edx, dword [edx + 0xc]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x70]
test byte [ebx], al
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ebx + 8]
lea eax, [edx - 1]
and eax, dword [esp + 0x1c]
cmp ecx, eax
ja 0x480199
jmp 0x480273
lea eax, [ebx + eax*8]
mov dword [esp + 0x50], eax
jmp 0x4801a2
test byte [eax], al
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], 0
lea eax, [0x512360]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov ecx, dword [esp + 0x48]
cmp ecx, eax
je 0x4801d5
jmp 0x480210
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.00405220
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4801fc
jmp 0x48020e
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
jmp 0x480212
jmp 0x480212
jmp 0x480212
mov eax, dword [esp + 0x50]
test byte [eax], al
mov ecx, dword [0x5efdd0]
test ecx, ecx
je 0x480224
jmp 0x480226
jmp 0x480232
mov ecx, dword [eax + 4]
call fcn.004757b0
mov dword [edi], ecx
jmp 0x480232
mov dword [eax + 4], 0
mov eax, dword [esp + 0x50]
test byte [eax], al
mov dword [esp + 0x54], eax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0046b590
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov byte [esp + 0x7c], 1
add esp, 0x6c
ret
jmp 0x48026e
jmp 0x480096
call fcn.00475840
nop
call fcn.004743b0
jmp fcn.00480060
Function at 0x492830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4929f1
sub esp, 0x60
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x492866
jmp 0x492885
mov eax, dword [esp + 0x64]
shl eax, 6
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffffa
mov dword [esp + 0x74], eax
mov byte [esp + 0x78], 1
add esp, 0x60
ret
cmp dword [esp + 0x6c], 0xfffffea4
setl dl
mov byte [esp + 0x23], dl
jl 0x492898
jmp 0x49289a
jmp 0x4928ab
cmp dword [esp + 0x6c], 0x15b
setg dl
mov byte [esp + 0x23], dl
jmp 0x4928ab
movzx edx, byte [esp + 0x23]
test dl, dl
jne 0x4929d8
jmp 0x4928ba
mov edx, dword [esp + 0x6c]
lea eax, [edx + 0x15c]
cmp eax, 0x2b8
jb 0x4928d0
jmp 0x4929ce
shl eax, 4
lea ecx, [0x5ca080]
lea edx, [ecx + eax]
mov edx, dword [edx + 0xc]
lea eax, [ecx + eax + 8]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x6c]
test ecx, ecx
jl 0x4928f7
jmp 0x492907
add eax, 1
mov dword [esp + 0x24], eax
adc edx, 0
mov dword [esp + 0x28], edx
jmp 0x492909
jmp 0x492909
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x64]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call fcn.0048b3f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.00491db0
mov eax, dword [esp + 4]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x68]
lea eax, [eax + ecx - 6]
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x34]
shl ecx, 7
mov edx, dword [esp + 0x30]
shr edx, 0x19
or edx, ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, eax
shl eax, 7
shl ecx, 7
shr edx, 0x19
or ecx, edx
test eax, eax
sete al
test ecx, ecx
sete cl
and ecx, eax
mov byte [esp + 0x78], cl
add esp, 0x60
ret
mov ecx, 0x2b8
call fcn.00475830
lea eax, [0x5115e0]
mov dword [esp], eax
lea eax, [0x53a8e0]
mov dword [esp + 4], eax
call fcn.0046fd20
nop
call fcn.004743b0
jmp fcn.00492830
Function at 0x493030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4931ba
sub esp, 0x64
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x6c]
test eax, eax
sete cl
and ecx, 1
test eax, eax
setg al
or eax, ecx
mov byte [esp + 0x32], al
test al, al
jne 0x493074
jmp 0x493094
mov eax, dword [esp + 0x6c]
test eax, eax
sete cl
test eax, eax
setl al
cmp dword [esp + 0x68], 0x64
setb dl
and ecx, edx
or eax, ecx
mov byte [esp + 0x32], al
jmp 0x493096
jmp 0x493096
movzx eax, byte [esp + 0x32]
mov byte [esp + 0x33], al
test al, al
jne 0x4930a5
jmp 0x4930b3
cmp dword [esp + 0x70], 0xa
sete al
mov byte [esp + 0x33], al
jmp 0x4930b5
jmp 0x4930b5
movzx eax, byte [esp + 0x33]
test al, al
jne 0x4930c0
jmp 0x4930e8
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.00493240
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x64
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x6c]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
test ebx, ebx
setl al
mov byte [esp + 0x18], al
mov byte [esp + 0x19], 0
call fcn.00493340
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x64
ret
call fcn.004743b0
jmp fcn.00493030
Function at 0x498750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x498953
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00475a03
mov ecx, dword [esp + 0x5c]
test ecx, ecx
setl cl
mov byte [esp + 0xf], cl
jl 0x498783
jmp 0x498785
jmp 0x49879f
mov edx, dword [esp + 0x58]
test byte [edx], al
mov edx, dword [edx + 0x28]
mov dword [esp + 0x10], edx
cmp dword [esp + 0x5c], edx
setge dl
mov byte [esp + 0xf], dl
jmp 0x49879f
movzx edx, byte [esp + 0xf]
test dl, dl
jne 0x49893a
jmp 0x4987ae
mov edx, dword [esp + 0x58]
test byte [edx], al
mov ecx, dword [edx + 0x28]
mov edx, dword [edx + 0x24]
mov eax, dword [esp + 0x5c]
cmp ecx, eax
ja 0x4987c7
jmp 0x498935
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov dword [esp + 0x1c], eax
test byte [eax], al
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
mov dword [esp], eax
call fcn.0049f040
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov eax, dword [eax]
mov dword [esp + 0x50], eax
mov dword [esp], eax
call fcn.00401e60
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00401b70
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov byte [esp + 0x90], al
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov eax, dword [eax]
mov dword [esp + 0x4c], eax
mov dword [esp], eax
call fcn.00401c50
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
test al, al
jne 0x498865
jmp 0x498867
jmp 0x498896
mov eax, dword [esp + 0x58]
test byte [eax], al
mov eax, dword [eax + 0x20]
mov dword [esp + 0x48], eax
mov dword [esp], eax
call fcn.00401e60
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
jmp 0x498896
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov eax, dword [eax]
mov dword [esp + 0x44], eax
mov dword [esp], eax
call fcn.00401f10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
test ecx, ecx
jne 0x4988c0
jmp 0x4988ca
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
jmp 0x4988cc
jmp 0x4988cc
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov eax, dword [eax + 8]
mov dword [esp + 0x80], eax
lea eax, [0x510a60]
mov dword [esp], eax
call fcn.0040dc80
mov eax, dword [esp + 4]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x5c]
mov dword [eax], ecx
mov eax, dword [esp + 0x34]
test byte [eax], al
jmp 0x498900
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 1
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], 1
add esp, 0x54
ret
call fcn.00475830
lea eax, [0x5115e0]
mov dword [esp], eax
lea eax, [0x53a970]
mov dword [esp + 4], eax
call fcn.0046fd20
nop
call fcn.004743b0
jmp fcn.00498750
Function at 0x4a0510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a0627
sub esp, 0x1c
mov dword [esp + 0x24], 0
lea eax, [0x5129c0]
mov dword [esp], eax
call fcn.0040dc80
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004a03a0
mov dword [esp + 0xc], 0
jmp 0x4a0563
cmp dword [esp + 0xc], 0x100
jl 0x4a056f
jmp 0x4a0598
mov edx, dword [esp + 0x14]
test byte [edx], al
mov eax, dword [esp + 0xc]
cmp eax, 0x100
jb 0x4a0585
jmp 0x4a061c
lea edx, [edx + eax*4]
mov edx, dword [edx]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
jmp 0x4a05a4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
add esp, 0x1c
ret
cmp dword [esp + 8], 8
jl 0x4a05ad
jmp 0x4a05fd
mov edx, dword [esp + 0x14]
test byte [edx], al
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea edx, [edx + ebx*4]
mov ebx, dword [esp + 0x10]
shr ebx, 8
xor ebx, dword [edx]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
test byte [edx], al
cmp eax, 8
jb 0x4a05de
jmp 0x4a0612
shl eax, 0xa
add edx, eax
mov eax, dword [esp + 0xc]
cmp eax, 0x100
jb 0x4a05f0
jmp 0x4a0608
lea edx, [edx + eax*4]
mov dword [edx], ebx
jmp 0x4a05f7
inc dword [esp + 8]
jmp 0x4a05a4
jmp 0x4a05ff
inc dword [esp + 0xc]
jmp 0x4a0563
mov ecx, 0x100
call fcn.00475830
mov ecx, 8
call fcn.00475830
mov ecx, 0x100
call fcn.00475830
nop
call fcn.004743b0
jmp fcn.004a0510
Function at 0x4a4130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a41d3
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp], 0
jmp 0x4a4160
cmp dword [esp], 8
jl 0x4a4168
jmp 0x4a41bf
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
and eax, 0xff
xor eax, dword [esp + 8]
mov dword [esp + 8], eax
mov edx, dword [esp + 0x14]
mov ebx, edx
shr edx, 8
shl ebx, 0x18
mov ebp, dword [esp + 0x10]
shr ebp, 8
or ebp, ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov edx, 0x1b3
mov ebx, eax
mul edx
mov dword [esp + 8], eax
shl ebx, 8
imul ecx, ecx, 0x1b3
add ecx, edx
add ecx, ebx
mov dword [esp + 0xc], ecx
jmp 0x4a41ba
inc dword [esp]
jmp 0x4a4160
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
add esp, 4
ret
call fcn.004743b0
jmp fcn.004a4130

Function at 0x4a41e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a426d
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
jmp 0x4a420c
cmp dword [esp], 4
jl 0x4a4214
jmp 0x4a4259
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
and eax, 0xff
xor eax, dword [esp + 8]
mov dword [esp + 8], eax
mov edx, dword [esp + 0x10]
shr edx, 8
mov dword [esp + 0x10], edx
mov edx, 0x1b3
mov ebx, eax
mul edx
mov dword [esp + 8], eax
shl ebx, 8
imul ecx, ecx, 0x1b3
add ecx, edx
add ecx, ebx
mov dword [esp + 0xc], ecx
jmp 0x4a4254
inc dword [esp]
jmp 0x4a420c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
add esp, 4
ret
call fcn.004743b0
jmp fcn.004a41e0