joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push ebx
movzx ebx, byte [edi + 5]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movzx edx, byte [edi + 1]
mov dword [ebp - 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [edi + 2]
push esi
mov esi, dword [eax]
lea eax, [edi + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [ebp - 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [ebp - 0xb], al
mov eax, ecx
mov ebx, ecx
mov byte [ebp - 0xc], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 0xa], al
mov byte [ebp - 9], cl
mov ecx, edx
mov eax, edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 8], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ebx
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x49fa97
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea esp, [esp]
dec dword [ebp - 0x14]
test esi, esi
jne 0x49fa1a
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.004a0040
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x20]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [ebp - 0xa], cl
mov ecx, eax
mov byte [ebp - 9], dl
mov edx, eax
mov byte [ebp - 8], al
shr ecx, 8
shr eax, 0x18
shr edx, 0x10
add esp, 8
inc dword [ebp - 0x1c]
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 5], al
mov eax, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 6], dl
mov dl, byte [ebp + esi - 0xc]
xor dl, byte [eax]
inc esi
mov byte [ecx + eax], dl
inc eax
and esi, 7
cmp dword [ebp - 0x14], 0
mov dword [ebp + 8], eax
jne 0x49f9c0
cmp dword [ebp - 0x1c], 0
je 0x49fa82
mov eax, dword [ebp - 0x2c]
mov byte [edi], bl
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
mov ecx, dword [ebp - 0x20]
mov edx, ebx
shr edx, 0x10
mov byte [eax + 1], dl
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
mov dword [ecx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [edx], esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x49fab0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, edx
push edi
mov byte [esi], 0
cmp eax, 0x80
jle 0x49facc
mov eax, 0x80
test ecx, ecx
jle 0x49fad8
cmp ecx, 0x400
jle 0x49fae0
mov ecx, 0x400
mov dword [ebp + 0x10], ecx
push ebx
test eax, eax
jle 0x49fafc
mov edi, dword [ebp + 0xc]
sub edi, esi
mov ebx, eax
lea esp, [esp]
mov cl, byte [edi + edx]
mov byte [edx], cl
inc edx
dec ebx
jne 0x49faf0
mov ecx, dword [ebp + 0x10]
movzx edx, byte [esi + eax - 1]
cmp eax, 0x80
jge 0x49fb2e
mov edi, esi
sub edi, eax
lea esp, [esp]
movzx ebx, byte [edi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x5c6128]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x80
jl 0x49fb10
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea edi, [eax + esi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [edi]
and ebx, ecx
movzx ecx, byte [ebx + 0x5c6128]
mov byte [edi], cl
test eax, eax
je 0x49fb74
lea esp, [esp]
movzx ebx, byte [edi + edx - 1]
dec edi
xor ebx, ecx
dec eax
movzx ecx, byte [ebx + 0x5c6128]
mov byte [edi], cl
jne 0x49fb60
lea ecx, [esi + 0xfc]
lea eax, [esi + 0x7e]
mov edx, 0x40
pop ebx
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
dec edx
jne 0x49fb83
pop edi
pop esi
pop ebp
ret
Function at 0x4a08f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.00596bf0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x14]
mov dword [ebp - 4], edi
cmp ebx, edi
jbe 0x4a099a
mov eax, dword [esi + 0x18]
cmp ebx, eax
jb 0x4a094f
mov edx, dword [esi + 0x40]
mov ecx, ebx
sub ecx, eax
add ecx, 4
and ecx, 0xfffffffc
add eax, ecx
push 0x71
mov dword [esi + 0x18], eax
push str.....cryptomodesocb128.c
shl eax, 4
push eax
push edx
call fcn.00419760
add esp, 0x10
test eax, eax
jne 0x4a094c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], eax
cmp edi, ebx
jae 0x4a0997
mov eax, dword [ebp - 4]
sub ebx, eax
shl edi, 4
add eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x40]
mov bl, byte [edi + eax]
lea ecx, [edi + eax]
shr bl, 7
lea esi, [ecx + 0x10]
neg bl
push 1
mov edx, esi
and bl, 0x87
call fcn.004a0840
xor byte [esi + 0xf], bl
mov esi, dword [ebp + 8]
add esp, 4
add edi, 0x10
dec dword [ebp - 8]
jne 0x4a0963
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov dword [esi + 0x14], edi
mov eax, ebx
shl eax, 4
add eax, dword [esi + 0x40]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1be0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004a16b0
add esp, 4
test eax, eax
js 0x4a1e27
mov edx, dword [edi + 0xf0]
add edx, edx
push ebx
push esi
add edx, edx
xor esi, esi
test edx, edx
jle 0x4a1c50
lea ecx, [edi + edx*4 + 8]
lea eax, [edi + 8]
mov ebx, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebx
mov ebx, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebx
mov ebx, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebx
mov ebx, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4a1c11
mov edi, dword [ebp + 8]
mov edx, 1
cmp dword [edi + 0xf0], edx
jle 0x4a1e23
lea eax, [edi + 2]
jmp 0x4a1c70
mov ecx, dword [eax + 0xe]
movzx ebx, byte [eax + 0xf]
mov ebx, dword [ebx*4 + 0x5c43d8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5c43d8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5c4fd8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c57d8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c43d8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5c5bd8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x5c43d8]
movzx ebx, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5c53d8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov ebx, dword [ebx*4 + 0x5c43d8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5c43d8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5c4fd8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c57d8]
movzx ebx, byte [eax + 4]
mov ebx, dword [ebx*4 + 0x5c43d8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c53d8]
movzx ebx, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c43d8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5c5bd8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov ebx, dword [ebx*4 + 0x5c43d8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5c43d8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5c4fd8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c57d8]
movzx ebx, byte [eax + 8]
mov ebx, dword [ebx*4 + 0x5c43d8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c53d8]
movzx ebx, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c43d8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5c5bd8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov ebx, dword [ebx*4 + 0x5c43d8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5c43d8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5c4fd8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c57d8]
movzx ebx, byte [eax + 0xc]
mov ebx, dword [ebx*4 + 0x5c43d8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c43d8]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x5c53d8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5c5bd8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [edi + 0xf0]
jl 0x4a1c70
pop esi
xor eax, eax
pop ebx
pop edi
pop ebp
ret
Function at 0x4a2dd0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.00596bf0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1048
push 0x5c2f90
push ebx
mov edi, ecx
mov esi, edx
call fcn.0057e070
add esp, 0xc
cmp esi, 0x48
jle 0x4a2e04
mov esi, 0x48
lea ecx, [esi + edi]
mov eax, edi
lea esi, [ebx + 8]
mov dword [ebp - 4], 6
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4a2e1d
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e2c
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e3b
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e4a
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4a2e57
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e66
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e75
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2e84
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4a2e91
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2ea0
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2eaf
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4a2ebe
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [ebp - 4]
jne 0x4a2e13
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
xor esi, esi
lea esp, [esp]
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0053d680
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4a2ee0
xor esi, esi
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0053d680
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x4a2f04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
inc eax
push ebx
movzx ebx, byte [eax + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
push esi
mov esi, dword [ecx]
movzx ecx, byte [eax - 1]
push edi
mov edi, edx
movzx edx, byte [eax]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
test edi, edi
je 0x4a30e6
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
sub ebx, edi
lea ebx, [ebx]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4a3066
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0053d680
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov byte [ebp - 0xb], dl
mov edx, dword [ebp - 0x1c]
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [ebp - 0x18]
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
xor al, byte [edi]
inc esi
mov byte [ebx + edi], al
inc edi
and esi, 7
cmp dword [ebp - 0x14], 0
jne 0x4a3010
cmp dword [ebp - 0x18], 0
je 0x4a30d0
mov edi, dword [ebp - 0x30]
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [ebp - 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x4a6440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
inc eax
push ebx
movzx ebx, byte [eax + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
push esi
mov esi, dword [ecx]
movzx ecx, byte [eax - 1]
push edi
mov edi, edx
movzx edx, byte [eax]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
test edi, edi
je 0x4a65e6
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
sub ebx, edi
lea ebx, [ebx]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4a6566
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.004a5640
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov byte [ebp - 0xb], dl
mov edx, dword [ebp - 0x1c]
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [ebp - 0x18]
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
xor al, byte [edi]
inc esi
mov byte [ebx + edi], al
inc edi
and esi, 7
cmp dword [ebp - 0x14], 0
jne 0x4a6510
cmp dword [ebp - 0x18], 0
je 0x4a65d0
mov edi, dword [ebp - 0x30]
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [ebp - 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x4a7d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
inc eax
push ebx
movzx ebx, byte [eax + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
push esi
mov esi, dword [ecx]
movzx ecx, byte [eax - 1]
push edi
mov edi, edx
movzx edx, byte [eax]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
test edi, edi
je 0x4a7ef6
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
sub ebx, edi
lea ebx, [ebx]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4a7e76
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.004a83e0
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov byte [ebp - 0xb], dl
mov edx, dword [ebp - 0x1c]
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [ebp - 0x18]
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
xor al, byte [edi]
inc esi
mov byte [ebx + edi], al
inc edi
and esi, 7
cmp dword [ebp - 0x14], 0
jne 0x4a7e20
cmp dword [ebp - 0x18], 0
je 0x4a7ee0
mov edi, dword [ebp - 0x30]
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [ebp - 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x4aaaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push ebx
movzx ebx, byte [edi + 5]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movzx edx, byte [edi + 1]
mov dword [ebp - 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [edi + 2]
push esi
mov esi, dword [eax]
lea eax, [edi + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [ebp - 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [ebp - 0xb], al
mov eax, ecx
mov ebx, ecx
mov byte [ebp - 0xc], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 0xa], al
mov byte [ebp - 9], cl
mov ecx, edx
mov eax, edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 8], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ebx
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x4aac49
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea esp, [esp]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4aabcc
mov ecx, dword [ebp - 0x28]
push 1
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00528b40
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x20]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [ebp - 0xa], cl
mov ecx, eax
mov byte [ebp - 9], dl
mov edx, eax
mov byte [ebp - 8], al
shr ecx, 8
shr eax, 0x18
shr edx, 0x10
add esp, 0xc
inc dword [ebp - 0x1c]
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 5], al
mov eax, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 6], dl
mov dl, byte [ebp + esi - 0xc]
xor dl, byte [eax]
inc esi
mov byte [ecx + eax], dl
inc eax
and esi, 7
cmp dword [ebp - 0x14], 0
mov dword [ebp + 8], eax
jne 0x4aab70
cmp dword [ebp - 0x1c], 0
je 0x4aac34
mov eax, dword [ebp - 0x2c]
mov byte [edi], bl
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
mov ecx, dword [ebp - 0x20]
mov edx, ebx
shr edx, 0x10
mov byte [eax + 1], dl
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
mov dword [ecx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [edx], esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x4adf40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.00596bf0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, edx
shr ecx, 3
mov dword [ebp - 4], ecx
cmp eax, edx
jb 0x4ae033
jmp 0x4adf73
mov ecx, dword [ebp - 4]
xor esi, esi
test ecx, ecx
je 0x4ae019
lea ecx, [ecx]
movzx eax, byte [edi + 7]
cdq
shld edx, eax, 8
shl eax, 8
mov ecx, eax
movzx eax, byte [edi + 6]
mov ebx, edx
cdq
or ecx, eax
movzx eax, byte [edi + 5]
or ebx, edx
shld ebx, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 4]
or ebx, edx
shld ebx, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 3]
or ebx, edx
shld ebx, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 2]
or ebx, edx
shld ebx, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 1]
or ebx, edx
shld ebx, ecx, 8
cdq
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
or ebx, edx
shld ebx, ecx, 8
cdq
shl ecx, 8
or ebx, edx
or ecx, eax
push ebx
push ecx
add edi, 8
call fcn.004add20
mov ebx, dword [ebp + 8]
xor dword [ebx + esi*8], eax
xor dword [ebx + esi*8 + 4], edx
inc esi
add esp, 8
cmp esi, dword [ebp - 4]
jb 0x4adf80
mov esi, ebx
call fcn.004adbe0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub eax, ecx
mov dword [ebp + 0xc], eax
cmp eax, ecx
jae 0x4adf70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret