joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416970
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00407220
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x100c], eax
cmp ebx, 0x182
jne 0x4169a9
lea ecx, [ebp - 0x102c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x4169b9
cmp ebx, 0x19f
jne 0x4169b9
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
xor edi, edi
test ebx, ebx
jle 0x416a3d
push esi
jmp 0x4169d0
lea esi, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
call fcn.00416960
mov dl, byte [ebp - 0x1008]
mov eax, dword [ebp - 0x100c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x416a37
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.dafoyeyoromoluyavojikaduzigox
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, ebx
jl 0x4169d0
pop esi
pop edi
cmp ebx, 0x2d
jne 0x416a57
mov dword [0x511e28], 0xa62e7790
mov dword [0x511e2c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x416a70
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x511cf4]
push ebx
push esi
mov esi, dword [0x511b3c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x416a92
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x41aef0]
call fcn.00416930
cmp dword [0x511cf4], 0x2f
jne 0x416aad
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00416970
add esp, 4
cmp dword [0x511cf4], 0x568
pop esi
pop ebx
jne 0x416ad6
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x100011c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100011e5
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100011d4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100077ed
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebp
mov ebp, ecx
cmp byte [ebp + 0x20], 0
je 0x10007848
push ebx
mov ebx, dword [ebp]
mov eax, 0xfffff000
push edi
mov edi, dword [ebp + 4]
and ebx, eax
add edi, dword [ebp]
and edi, eax
lea eax, [esp + 0xc]
push eax
sub edi, ebx
push 0x40
add edi, 0xfff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 4]
push dword [ebp + 0x14]
push dword [ebp]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x10
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [ebp + 0x20], 0
pop ebx
pop ebp
pop ecx
ret

Function at 0x1000af50
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x1000af72
mov ecx, dword [esp + 4]
call fcn.1000e2a9
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x1000a8f0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
ret 0xc

Function at 0x1000b180
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014998
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1001f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
mov dword [ecx], vtable.BaseControl.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx], vtable.ColorPicker.0
mov byte [ecx + 0x38], 1
mov dword [ecx + 0x1c], 8
mov dword [ecx + 0x20], 4
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 8], 0x14
mov dword [ecx + 4], 0x64
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1000d7ad
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 2
jb 0x1000d7b9
mov eax, edx
pop esi
ret 4
Function at 0x1001036a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea edx, [ebp - 8]
and dword [ebp - 8], 0
push esi
push edi
mov edi, ecx
mov ecx, dword [0x1001faf0]
push edx
lea edx, [ebp - 4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x180]
mov eax, dword [edi + 4]
xor esi, esi
mov ecx, dword [edi + 8]
inc esi
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], ecx
mov ecx, dword [ebp - 8]
push esi
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100103c7
cmp dword [edi + 0x14], esi
je 0x100103c3
cmp dword [edi + 0x14], 3
jne 0x100103e8
push 3
jmp 0x100103e3
push 2
pop esi
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100103e6
cmp dword [edi + 0x14], esi
je 0x100103e1
cmp dword [edi + 0x14], 4
jne 0x100103e8
push 4
pop esi
jmp 0x100103e8
xor esi, esi
mov dword [edi + 0x14], esi
pop edi
pop esi
leave
ret
Function at 0x100130e9
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 8
ja case.default.0x100130f2
jmp dword [eax*4 + 0x10013131]
mov al, 1
jmp 0x1001312b
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001312b
push 2
jmp 0x100130ff
push 4
jmp 0x100130ff
push 5
jmp 0x100130ff
push 6
jmp 0x100130ff
push 0x10
jmp 0x100130ff
push 0x12
jmp 0x100130ff
push 0x46
jmp 0x100130ff
xor al, al
ret 4
Function at 0x417ae0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417b02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417b09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417af8
mov eax, 1
add ebx, ebx
jne 0x417b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417b10
jne 0x417b2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b10
xor ecx, ecx
sub eax, 3
jb 0x417b40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417bb2
mov ebp, eax
add ebx, ebx
jne 0x417b4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417b58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417b7c
inc ecx
add ebx, ebx
jne 0x417b68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417b5d
jne 0x417b79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417b9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417b8d
jmp 0x417afe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417b9c
add edi, ecx
jmp 0x417afe
pop esi
mov edi, esi
mov ecx, 0xf5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417bba
cmp byte [edi], 5
jne 0x417bba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417bbf
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417c37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417bec
mov ecx, edi
jns 0x417c1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417c31
mov dword [ebx], eax
add ebx, 4
jmp 0x417c09
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417c6b
sub esp, 0xffffff80
jmp 0x403b58
Function at 0x409970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4099c2
test eax, edx
je 0x4099c5
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409985
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4099ab
add ecx, 4
js 0x40999b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4099a8
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4099d1
test edx, edx
jne 0x409978
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42c628
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42c62e
ret
Function at 0x446924
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x446adf
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004056b8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x446af8
call fcn.0040524c
mov eax, ebx
call fcn.00425f94
mov edi, eax
dec edi
test edi, edi
jl 0x4469dc
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00425f68
mov edx, dword [0x438560]
call fcn.004041a0
test al, al
je 0x4469d8
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00425f68
lea edx, [ebp - 0x14]
call fcn.00456750
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004056b8
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004052c8
inc esi
dec edi
jne 0x44698a
movzx eax, byte [0x446afc]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x446b08
mov eax, dword [ebp - 8]
call fcn.0040fd8c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404fcc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00456750
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x446af8
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00456750
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x446af8
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x446af8
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x446b14
call fcn.0040b4dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446ae6
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404f58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404f58
lea eax, [ebp - 0x14]
call fcn.00404f34
lea eax, [ebp - 0x10]
call fcn.00404f34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f58
ret

Function at 0x47e6a0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403900
ret
Function at 0x482b44
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
mov esi, ecx
mov ebx, eax
add edx, eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
movzx eax, word [ebx]
mov dword [esp], eax
or eax, eax
je 0x482ce7
add ebx, 2
mov eax, dword [esp]
test ah, 0x80
je 0x482ba2
and eax, 0x7fff
movzx edx, word [ebx]
shl edx, 0xf
or eax, edx
mov dword [esp], eax
add ebx, 2
lea ebp, [esi - 1]
mov ecx, dword [ebx]
add ebx, 4
mov dword [esp + 0x14], ecx
mov edi, 1
cmp ebx, dword [esp + 0x10]
jae 0x482ce7
mov ecx, dword [esp + 0x14]
test ecx, edi
jne 0x482bf6
mov al, byte [ebx]
inc ebx
mov byte [esi], al
inc esi
cmp ebx, dword [esp + 0x10]
lea eax, [esi - 3]
jae 0x482ce7
cmp eax, ebp
jbe 0x482bf0
inc ebp
mov eax, dword [ebp]
mov edx, eax
shr eax, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
add edi, edi
jne 0x482bc1
jmp 0x482ba5
movzx edx, word [ebx]
add ebx, 2
mov eax, edx
and edx, 0xf
add edx, 2
shr eax, 4
cmp edx, 2
jne 0x482c13
movzx edx, byte [ebx]
inc ebx
add edx, 0x12
mov eax, dword [esp + eax*4 + 0x1c]
mov ecx, esi
mov dword [esp + 0x18], edx
sub ecx, eax
cmp ecx, edx
jl 0x482cd1
cmp edx, 0x20
ja 0x482c6d
sub edx, 8
jg 0x482c3b
movq xmm0, qword [eax]
movq qword [esi], xmm0
jmp 0x482c9b
movq xmm0, qword [edx + eax]
movq xmm1, qword [eax]
cmp edx, 8
jle 0x482c62
movq xmm2, qword [eax + 8]
cmp edx, 0x10
jle 0x482c5d
movq xmm3, qword [eax + 0x10]
movq qword [esi + 0x10], xmm3
movq qword [esi + 8], xmm2
movq qword [esi], xmm1
movq qword [edx + esi], xmm0
jmp 0x482c9b
push esi
movups xmm2, xmmword [eax]
lea eax, [edx + eax - 0x10]
lea edx, [edx + esi - 0x10]
movups xmm1, xmmword [eax]
push edx
neg edx
and esi, 0xfffffff0
lea edx, [esi + edx + 0x10]
pop esi
movups xmm0, xmmword [edx + eax]
movaps xmmword [edx + esi], xmm0
add edx, 0x10
jl 0x482c87
movups xmmword [esi], xmm1
pop esi
movups xmmword [esi], xmm2
cmp esi, ebp
jbe 0x482cb7
inc ebp
mov edx, dword [ebp]
mov eax, edx
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
cmp esi, ebp
ja 0x482c9f
add esi, dword [esp + 0x18]
cmp ebx, dword [esp + 0x10]
jae 0x482ce7
add edi, edi
lea ebp, [esi - 1]
je 0x482ba5
jmp 0x482bbd
push ebx
push esi
lea ebx, [edx + eax]
add esi, edx
neg edx
mov al, byte [edx + ebx]
mov byte [edx + esi], al
inc edx
jne 0x482cda
pop esi
pop ebx
jmp 0x482c9b
mov eax, dword [esp]
add esp, 0x401c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x483364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, esi
dec ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
add dword [ebp - 4], 4
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x4834a7
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x10]
jne 0x4833df
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov byte [esi], al
inc dword [ebp - 4]
inc esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x4834a7
mov eax, esi
sub eax, 3
cmp ebx, eax
jae 0x4833d4
inc ebx
mov eax, dword [ebx]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ebx
shl dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x483396
jmp 0x483377
mov eax, dword [ebp - 4]
movzx eax, word [eax]
add dword [ebp - 4], 2
mov edx, eax
and edx, 0xf
add edx, 2
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 2
jne 0x483409
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
add edx, 0x12
mov dword [ebp - 0x14], edx
inc dword [ebp - 4]
shr eax, 4
mov edx, dword [ebp + 8]
mov edx, dword [edx + eax*4]
mov ecx, esi
sub ecx, edx
cmp ecx, dword [ebp - 0x14]
jae 0x483443
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
neg eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + eax], dl
inc eax
test eax, eax
jne 0x48342f
jmp 0x48346a
cmp dword [ebp - 0x14], 8
jbe 0x48345a
mov ecx, dword [ebp + 8]
mov eax, edx
mov edx, esi
mov ecx, dword [ebp - 0x14]
call fcn.00482178
jmp 0x48346a
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x4834a7
cmp esi, ebx
jbe 0x48348f
inc ebx
mov eax, dword [ebx]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ebx
cmp esi, ebx
ja 0x483476
add esi, dword [ebp - 0x14]
mov ebx, esi
dec ebx
shl dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x483396
jmp 0x483377
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x491d28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
movzx edx, byte [ebx]
cmp dl, 7
je 0x491ddf
and edx, 0x7f
imul edx, edx, 0x23
mov eax, dword [eax + 4]
lea edi, [eax + edx*4 - 0x8c]
mov esi, dword [edi + 8]
test esi, esi
je 0x491d5b
cmp ebx, dword [esi + 4]
je 0x491df1
movzx eax, byte [ebx + 1]
movzx edx, byte [ebx + 2]
xor eax, edx
and eax, 0x1f
lea ebp, [edi + eax*4 + 0xc]
mov esi, dword [ebp]
test esi, esi
je 0x491df1
mov esi, edi
mov eax, dword [esi]
and eax, 0xfffffffe
mov dword [esp], eax
mov edx, dword [esp]
add edx, 2
mov eax, esi
mov ecx, dword [esp]
call fcn.00482ef4
test al, al
jne 0x491d98
mov eax, esi
call fcn.00488ef4
mov edx, dword [ebp]
mov eax, edx
test eax, eax
je 0x491dc8
mov edx, eax
cmp ebx, dword [edx]
je 0x491dc5
mov ecx, edx
sub ecx, 4
mov ecx, dword [ecx]
lea edx, [edx + ecx*4 - 4]
add eax, 8
mov esi, eax
cmp esi, edx
ja 0x491dc1
cmp ebx, dword [esi]
je 0x491dc5
jmp 0x491db2
xor eax, eax
jmp 0x491dc8
mov eax, dword [eax + 4]
mov esi, eax
mov eax, edi
mov edx, 2
call fcn.00482f00
test esi, esi
je 0x491df1
mov dword [edi + 8], esi
jmp 0x491df1
mov eax, ebx
movzx edx, byte [eax + 1]
add edx, 2
add eax, edx
mov eax, dword [eax]
add eax, 0xffffffbc
mov esi, dword [eax]
mov eax, esi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x492bf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, eax
mov eax, dword [ebp + 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp + 0x18]
xor eax, ecx
mov ecx, dword [ebp + 0x1c]
add ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x18], eax
xor eax, edx
mov dword [ebp + 0x14], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0x529050]
add eax, ecx
mov ecx, dword [ebp + 0xc]
add eax, dword [ebp + edi*4 + 0x20]
mov ebx, dword [ebp]
add ecx, eax
mov esi, eax
mov dword [ebp + 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp + 4]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp + 8]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp], esi
mov eax, dword [ebp + 8]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
cmp edi, 0x40
jne 0x492bf8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492ccc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x492d57
pop ebx
pop edi
pop esi
ret

Function at 0x492e24
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [edx]
movups xmm5, xmmword [0x492eb8]
cmp al, 0x80
je 0x492f57
cmp al, 0xc0
je 0x492fc8
movups xmm3, xmmword [edx + 0x10]
add edx, 0x20
aeskeygenassist xmm2, xmm3, 1
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 2
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 4
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 8
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 0x10
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 0x20
call fcn.00492ec8
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
ret
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 2
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 4
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 8
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x10
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x20
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x40
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x80
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.00492f29
aeskeygenassist xmm2, xmm1, 0x36
call fcn.00492f29
ret
Function at 0x492ec8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movups xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movups xmmword [edx], xmm3
add edx, 0x10
ret

Function at 0x4939ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0x545800
cmp dword [esp + 4], 0
jle 0x493a2a
and edx, 0x1fff
mov ecx, 0x2000
sub ecx, edx
cmp ecx, dword [esp + 4]
jle 0x4939df
mov ecx, dword [esp + 4]
mov edi, dword [esp]
mov eax, dword [esp + 8]
add eax, edx
mov esi, ecx
cmp esi, 4
jl 0x493a01
sub esi, 4
mov ebx, dword [eax]
xor dword [edi], ebx
add edi, 4
add eax, 4
cmp esi, 4
jge 0x4939ef
test esi, esi
jle 0x493a11
dec esi
movzx ebx, byte [eax + esi]
xor byte [edi + esi], bl
test esi, esi
jg 0x493a05
mov eax, ecx
neg eax
shl eax, 0x1f
sub eax, ecx
add dword [esp], eax
add edx, ecx
sub dword [esp + 4], ecx
cmp dword [esp + 4], 0
jne 0x4939c8
add esp, 0xc
pop edi
pop esi
pop ebx
ret