joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10007082
pop dword [ebp - 0x40]
mov eax, 0x10007082
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x39b11
push 0
mov eax, 0x54957f95
add eax, 0xbb6bc0cf
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xee90e891
sub ecx, 0xee909deb
xor edx, edx
add edx, eax
mov esi, 0x10018600
add esi, dword [ebp - 0x40]
mov ebx, 0xbb3cd1fc
sub ebx, 0xa9dc4276
mov edi, dword [esi]
sub dword [ebp - 0x18], 0x6b2d8dbd
add edi, ebx
mov dword [edx], edi
xor dword [ebp - 0x38], 0x3e227ef2
add edx, 4
add esi, 0xf5335fe3
add esi, 0xacca021
loop 0x100070d8
add eax, 0x11d6b
xor ebx, ebx
add ebx, eax
add eax, 0x53461854
sub eax, 0x5346184f
mov ecx, 0x258f6724
sub ecx, 0x158f6724
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x403421
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x11c
push ebx
push edi
mov edi, eax
cmp edi, dword [ebp + 0x7c]
sbb ebx, ebx
inc ebx
je 0x403443
push dword [ebp + 0x7c]
push dword [ebp + 0x74]
jmp 0x4034d3
push 0x40
lea eax, [ebp + 0x24]
push 0x36
push eax
call fcn.00497bc6
push 0x40
lea eax, [ebp - 0x1c]
push 0x5c
push eax
call fcn.00497bc6
add esp, 0x18
test edi, edi
jbe 0x403484
mov eax, dword [ebp + 0x74]
push esi
lea edx, [ebp + 0x24]
lea esi, [ebp - 0x1c]
sub edx, eax
sub esi, eax
mov dword [ebp + 0x64], edi
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec dword [ebp + 0x64]
jne 0x403475
pop esi
push edi
lea eax, [ebp - 0xb4]
push eax
push 0x40
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x70]
call fcn.0040325b
add esp, 0x14
test eax, eax
je 0x4034de
push edi
lea eax, [ebp + edi - 0xb4]
push eax
push 0x40
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x70]
call fcn.0040325b
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4034de
add edi, edi
cmp dword [ebp + 0x7c], edi
jae 0x4034cb
mov edi, dword [ebp + 0x7c]
push edi
lea eax, [ebp - 0xb4]
push eax
push dword [ebp + 0x78]
call fcn.00497bcc
add esp, 0xc
pop edi
mov eax, ebx
pop ebx
add ebp, 0x68
leave
ret
Function at 0x4036a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push 0xf0000000
push 0x18
xor ebx, ebx
push ebx
mov edi, eax
push ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], ebx
call dword [0x49e00c]
test eax, eax
je 0x403853
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [0x49e034]
test eax, eax
je 0x403849
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [ebp - 0x18]
call dword [0x49e004]
test eax, eax
je 0x403840
push esi
mov esi, dword [0x49e32c]
lea eax, [edi + 4]
push eax
push 0x40
mov dword [ebp - 0x24], eax
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40383f
push dword [ebp - 4]
push 0x40
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x403836
push dword [ebp - 4]
push 0x40
call esi
mov ebx, eax
test ebx, ebx
je 0x40382b
mov esi, dword [ebp - 0x10]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x20], 1
push esi
call fcn.00497bcc
add esp, 0xc
cmp dword [ebp + 0x20], 0
mov dword [ebp - 0xc], 1
jbe 0x403824
add edi, esi
mov eax, dword [ebp - 0xc]
bswap eax
mov dword [edi], eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403588
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call fcn.00497bcc
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp eax, 1
jbe 0x4037f7
dec eax
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403588
xor esi, esi
add esp, 0x18
cmp dword [ebp - 4], esi
jbe 0x4037dd
mov eax, dword [ebp - 8]
mov ecx, ebx
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
inc eax
cmp esi, dword [ebp - 4]
jb 0x4037d1
cmp dword [ebp + 0x24], 0
je 0x4037f2
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call fcn.00497bcc
add esp, 0xc
dec dword [ebp - 0x14]
jne 0x4037aa
mov esi, dword [ebp + 0x20]
cmp esi, dword [ebp - 4]
jb 0x403802
mov esi, dword [ebp - 4]
push esi
push dword [ebp - 8]
push dword [ebp + 0x1c]
call fcn.00497bcc
add dword [ebp + 0x1c], esi
sub dword [ebp + 0x20], esi
add esp, 0xc
inc dword [ebp - 0xc]
cmp dword [ebp + 0x20], 0
ja 0x403770
push ebx
call dword [0x49e324]
push dword [ebp - 8]
call dword [0x49e324]
xor ebx, ebx
push dword [ebp - 0x10]
call dword [0x49e324]
pop esi
push dword [ebp - 0x18]
call dword [0x49e044]
push ebx
push dword [ebp - 0x1c]
call dword [0x49e018]
mov eax, dword [ebp - 0x20]
pop edi
pop ebx
leave
ret
Function at 0x403892
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x10
mov esi, eax
xor ebx, ebx
pop edi
mov dword [ebp - 0xc], ebx
cmp esi, edi
jbe 0x4039ce
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp + 8]
call dword [0x49e01c]
test eax, eax
je 0x4039e4
push ebx
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call dword [0x49e010]
test eax, eax
je 0x4039c3
lea ebx, [esi + 0xf]
shr ebx, 4
and esi, 0xf
je 0x4038eb
mov dword [ebp - 8], esi
jmp 0x4038f0
mov dword [ebp - 8], edi
mov esi, edi
cmp ebx, 2
jbe 0x403911
push 0
lea eax, [ebx - 2]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x10
test eax, eax
je 0x4039c3
lea edi, [ebx - 2]
shl edi, 4
add edi, dword [ebp + 0xc]
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.00497bcc
mov dword [ebp - 4], 0x10
sub dword [ebp - 4], esi
push dword [ebp - 4]
lea eax, [ebp + esi - 0x28]
push 0
push eax
mov dword [ebp - 0x18], eax
call fcn.00497bc6
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x10
call dword [0x49e040]
test eax, eax
je 0x4039c3
xor eax, eax
mov cl, byte [ebp + eax - 0x28]
xor byte [ebp + eax - 0x38], cl
inc eax
cmp eax, 0x10
jb 0x40396a
push dword [ebp - 4]
lea eax, [ebp + esi - 0x38]
push eax
push dword [ebp - 0x18]
call fcn.00497bcc
push 0
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4039c3
push dword [ebp - 8]
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
shl ebx, 4
lea eax, [ebx + eax - 0x10]
push eax
movsd dword es:[edi], dword [esi]
call fcn.00497bcc
add esp, 0xc
push dword [ebp - 0x10]
call dword [0x49e03c]
jmp 0x4039e4
jne 0x4039e4
push ebx
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406658
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xa0
and dword [ebp + 0x50], 0
push ebx
push esi
push edi
push 0x40
mov edi, eax
lea eax, [ebp - 8]
push 0x36
push eax
call fcn.00497bc6
push 0x40
lea eax, [ebp - 0x48]
push 0x5c
push eax
call fcn.00497bc6
add esp, 0x18
test edi, edi
jbe 0x4066a6
mov eax, dword [ebp + 0x60]
lea edx, [ebp - 8]
lea esi, [ebp - 0x48]
sub edx, eax
sub esi, eax
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec edi
jne 0x40669a
mov eax, dword [ebp + 0x68]
mov ebx, dword [0x49e32c]
add eax, 0x40
push eax
push 0x40
mov dword [ebp + 0x4c], eax
call ebx
mov dword [ebp + 0x54], eax
test eax, eax
je 0x406795
push 0x10
pop ecx
push dword [ebp + 0x68]
mov edi, eax
push dword [ebp + 0x64]
add eax, 0x40
lea esi, [ebp - 8]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00497bcc
push 0x14
lea eax, [ebp + 0x38]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x54]
push 0x8004
call fcn.0040325b
add esp, 0x20
test eax, eax
je 0x40678c
mov ecx, dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
lea eax, [eax + ecx + 0x54]
push eax
push 0x40
mov dword [ebp + 0x68], eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x40678c
cmp dword [ebp + 0x6c], 0
push 0x10
pop ecx
lea esi, [ebp - 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [ebx + 0x40]
pop ecx
lea esi, [ebp + 0x38]
rep movsd dword es:[edi], dword [esi]
je 0x40674a
cmp dword [ebp + 0x70], 0
je 0x40674a
push dword [ebp + 0x70]
lea eax, [ebx + 0x54]
push dword [ebp + 0x6c]
push eax
call fcn.00497bcc
add esp, 0xc
cmp dword [ebp + 0x74], 0
je 0x40676c
cmp dword [ebp + 0x78], 0
je 0x40676c
push dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x74]
lea eax, [ebx + eax + 0x54]
push eax
call fcn.00497bcc
add esp, 0xc
push 0x14
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
push ebx
push 0x8004
call fcn.0040325b
add esp, 0x14
push ebx
mov dword [ebp + 0x50], eax
call dword [0x49e324]
push dword [ebp + 0x54]
call dword [0x49e324]
mov eax, dword [ebp + 0x50]
pop edi
pop esi
pop ebx
add ebp, 0x58
leave
ret
Function at 0x40c4d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov al, byte [ebp + 0x14]
add al, 5
mov byte [ebp - 0x1a], al
push ebx
push edi
xor eax, eax
mov byte [ebp - 0x1c], 3
mov byte [ebp - 0x1b], 1
lea edi, [ebp - 0x19]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
push 0xff
stosb byte es:[edi], al
lea eax, [ebp - 0x11b]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11c], bl
call fcn.00497bc6
add esp, 0xc
cmp byte [ebp + 0x14], 0x12
jae 0x40c6cf
mov al, byte [ebp + 0xc]
push esi
movzx esi, byte [ebp + 0x14]
push esi
push dword [ebp + 0x10]
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x18]
push eax
call fcn.00497bcc
lea ecx, [esi + 3]
add esp, 0xc
xor al, al
cmp ecx, ebx
mov byte [ebp + 0x17], bl
jle 0x40c55e
xor edx, edx
xor al, byte [ebp + edx - 0x1b]
inc byte [ebp + 0x17]
movzx edx, byte [ebp + 0x17]
cmp edx, ecx
jl 0x40c54f
mov edi, dword [ebp + 8]
push 0xc
push edi
mov byte [ebp + esi - 0x18], al
mov byte [ebp + esi - 0x17], 4
call dword [0x49e478]
mov esi, dword [0x49e33c]
push 0x64
call esi
push ebx
lea eax, [ebp + 0x14]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [0x49e344]
test eax, eax
je 0x40c6bb
cmp dword [ebp + 0x14], 0x18
jne 0x40c6bb
push ebx
push ebx
push edi
call dword [0x49e250]
push 0x64
call esi
push ebx
lea eax, [ebp + 0x14]
push eax
push 0x100
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [0x49e338]
test eax, eax
je 0x40c6ad
cmp dword [ebp + 0x14], 6
jb 0x40c6a3
cmp byte [ebp - 0x11c], 5
jne 0x40c69c
cmp byte [ebp - 0x11b], 1
jne 0x40c69c
mov al, byte [ebp - 0x11a]
cmp al, 5
jb 0x40c695
mov cl, byte [ebp + 0xc]
or cl, 0x80
cmp byte [ebp - 0x119], cl
jne 0x40c695
sub al, 5
movzx esi, al
lea edx, [esi + 3]
xor cl, cl
cmp edx, ebx
jle 0x40c634
xor edi, edi
xor cl, byte [ebp + edi - 0x11b]
inc bl
movzx edi, bl
cmp edi, edx
jl 0x40c622
xor ebx, ebx
cmp byte [ebp + esi - 0x118], cl
jne 0x40c689
cmp byte [ebp + esi - 0x117], 4
jne 0x40c689
mov dword [ebp - 4], 1
cmp al, bl
je 0x40c6ce
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x40c6ce
mov ecx, dword [ebp + 0x1c]
cmp ecx, ebx
je 0x40c6ce
push esi
push 0x40
mov byte [ecx], al
call dword [0x49e32c]
mov dword [edi], eax
cmp eax, ebx
je 0x40c684
push esi
lea ecx, [ebp - 0x118]
push ecx
push eax
call fcn.00497bcc
add esp, 0xc
jmp 0x40c6ce
mov dword [ebp - 4], ebx
jmp 0x40c6ce
push 0x4b6af8
call fcn.00409709
jmp 0x40c6cd
push 0x4b6b48
jmp 0x40c68e
push 0x4b6bb0
jmp 0x40c68e
push dword [ebp + 0x14]
push 0x4b6c00
jmp 0x40c6c7
call dword [0x49e330]
push eax
push 0x4b6c58
jmp 0x40c6c7
call dword [0x49e330]
push eax
push 0x4b6cb8
call fcn.00409709
pop ecx
pop ecx
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x41abe7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, eax
lea eax, [esi + 0x88]
mov ebx, ecx
mov ecx, dword [eax]
test ecx, ecx
je 0x41ac0d
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
and dword [ecx + 0x10], 0
mov dword [edi], ecx
mov edi, dword [ecx + 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x41ac67
movzx eax, word [esi + 0x8c]
add eax, 0x28
push 0
push eax
call fcn.00412236
pop ecx
pop ecx
mov ecx, eax
mov dword [edi], ecx
test ecx, ecx
jne 0x41ac50
push dword [esp + 0xc]
mov eax, dword [esi + 0x98]
push ecx
cdq
dec ebx
push ebx
push edx
push eax
call fcn.0049d670
push edx
push eax
mov eax, dword [esi + 0x3c]
call fcn.00411b73
add esp, 0xc
push 7
pop eax
jmp 0x41ac76
lea eax, [ecx + 0x28]
mov dword [ecx + 8], eax
push 0x20
pop eax
mov word [ecx + 0x1c], ax
xor eax, eax
inc eax
mov word [ecx + 0x1e], ax
mov dword [ecx + 0x14], esi
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 0x18], ebx
inc dword [esi + 0x78]
xor eax, eax
pop edi
pop ebx
ret
Function at 0x46e5e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
push dword [ebp + 8]
call dword [0x49e244]
mov edi, eax
lea eax, [ebp - 0x68]
push eax
call fcn.00496868
mov esi, 0x5b6
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x68]
push eax
call fcn.00496862
dec esi
jne 0x46e603
lea eax, [ebp - 0x68]
push eax
call fcn.0049685c
xor eax, eax
mov cl, byte [eax + 0x4a1424]
xor cl, byte [ebp + eax - 0x10]
mov edx, dword [ebp + 0xc]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x10
jb 0x46e61e
pop edi
pop esi
leave
ret

Function at 0x46e638
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [0x49e244]
push edi
mov ebx, eax
push ebx
call esi
push 0x14
pop edi
cmp eax, edi
jge 0x46e652
push ebx
call esi
mov edi, eax
lea eax, [edi + 1]
push eax
push 0x40
call dword [0x49e32c]
test eax, eax
je 0x46e67f
test edi, edi
jbe 0x46e67f
mov edx, 0x4a1434
mov esi, eax
sub edx, ebx
mov ecx, ebx
sub esi, ebx
mov bl, byte [edx + ecx]
xor bl, byte [ecx]
mov byte [esi + ecx], bl
inc ecx
dec edi
jne 0x46e673
pop edi
pop esi
pop ebx
ret
Function at 0x483a12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, al
shl eax, 0x10
movzx ecx, cx
or eax, ecx
push ebx
add eax, eax
push esi
cdq
push edi
mov ebx, eax
mov esi, edx
xor edi, edi
or ebx, 0x4000000
or esi, 0x20
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
inc edi
mov dword [ebp - 0xc], 0xc
lea ecx, [edi + 0xc]
mov eax, ebx
mov edx, esi
call fcn.0049dc20
and al, 1
xor byte [ebp - 1], al
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.0049dc20
and al, 1
xor byte [ebp - 2], al
inc edi
dec dword [ebp - 0xc]
jne 0x483a48
movzx eax, byte [ebp - 1]
and eax, 1
shl eax, 0x19
xor ecx, ecx
cmp byte [ebp - 2], cl
sete cl
and ecx, 1
or eax, ecx
cdq
or ebx, eax
mov eax, dword [ebp + 0xc]
or esi, edx
mov dword [ebp - 0xc], esi
test eax, eax
je 0x483a9a
mov dword [eax], ebx
mov dword [eax + 4], esi
mov eax, dword [ebp + 8]
mov edx, esi
shr edx, 8
mov dword [eax], 0x90625062
call fcn.004839d8
movzx edi, al
mov edx, esi
or edi, 0x1d00
shr edx, 4
shl edi, 8
call fcn.004839d8
mov dl, byte [ebp - 0xc]
movzx eax, al
or edi, eax
shl edi, 8
call fcn.004839d8
movzx eax, al
or edi, eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x1c
shr eax, 0x1c
call fcn.004839d8
movzx edi, al
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x18
shl edi, 8
shr eax, 0x18
call fcn.004839d8
movzx eax, al
or edi, eax
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x14
shl edi, 8
shr eax, 0x14
call fcn.004839d8
movzx eax, al
or edi, eax
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x10
shl edi, 8
shr eax, 0x10
call fcn.004839d8
movzx eax, al
or edi, eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov edx, ebx
mov eax, esi
shrd edx, eax, 0xc
shr eax, 0xc
call fcn.004839d8
movzx edi, al
mov edx, ebx
mov eax, esi
shrd edx, eax, 8
shl edi, 8
shr eax, 8
call fcn.004839d8
movzx eax, al
mov edx, ebx
shrd edx, esi, 4
or edi, eax
shl edi, 8
shr esi, 4
call fcn.004839d8
movzx eax, al
or edi, eax
mov dl, bl
shl edi, 8
call fcn.004839d8
movzx eax, al
or edi, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x483b9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x20], 0
push ebx
push esi
push edi
mov byte [ebp - 4], 0
xor eax, eax
lea edi, [ebp - 3]
stosw word es:[edi], ax
push 0x24
stosb byte es:[edi], al
mov dword [ebp - 0x1c], 0xff800000
mov dword [ebp - 0xc], 0x32
mov dword [ebp - 8], 0x33
pop edi
mov dword [ebp - 0x10], 0xa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, edi
call fcn.0049dc20
and al, 0xf
xor cl, cl
xor bl, bl
lea esi, [ebp - 4]
mov dl, al
shr dl, cl
and dl, 1
xor byte [esi], dl
xor bl, dl
inc cl
inc esi
cmp cl, 4
jb 0x483be8
mov ecx, dword [ebp - 8]
movzx eax, al
cdq
call fcn.0049dc00
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov eax, edx
mov dword [ebp - 0x14], eax
movzx eax, bl
cdq
call fcn.0049dc00
sub dword [ebp - 8], 5
sub dword [ebp - 0xc], 5
or esi, eax
mov eax, dword [ebp - 0x14]
or dword [ebp - 0x20], esi
or eax, edx
or dword [ebp - 0x1c], eax
sub edi, 4
dec dword [ebp - 0x10]
jne 0x483bd2
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 2]
mov esi, dword [ebp - 0x1c]
add eax, eax
or eax, ecx
movzx ecx, byte [ebp - 3]
add eax, eax
or eax, ecx
movzx ecx, byte [ebp - 4]
add eax, eax
or eax, ecx
mov ecx, dword [ebp - 0x20]
add eax, eax
cdq
or ecx, eax
mov eax, dword [ebp + 8]
or esi, edx
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], 0x148040
mov dword [eax + 8], ecx
pop ebx
leave
ret
Function at 0x48f4d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 4
lea eax, [ebp - 4]
push eax
call dword [0x49e2c4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x49e2bc]
test eax, eax
je 0x48f5e7
push edi
push 0x61c
push esi
push esi
push 4
push dword [ebp - 4]
call dword [0x49e270]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
je 0x48f5c8
push ebx
push 0x610
push 0x40
call dword [0x49e32c]
mov ebx, eax
cmp ebx, esi
je 0x48f5bc
push 1
lea esi, [edi + 0xc]
push 0x610
mov ecx, 0x184
mov edi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00496700
test eax, eax
jl 0x48f5a8
mov eax, dword [ebx + 0x400]
xor edi, edi
xor cl, cl
mov dword [ebp - 8], eax
lea esi, [ebx + 0x404]
test eax, eax
jbe 0x48f584
mov al, byte [edi + esi]
mov dl, al
xor dl, cl
xor dl, 0x43
mov byte [edi + esi], dl
inc edi
mov cl, al
cmp edi, dword [ebp - 8]
jb 0x48f56f
push dword [ebx + 0x604]
lea eax, [ebx + 0x200]
push esi
push dword [ebx + 0x400]
push eax
push ebx
push 0x4ef940
call fcn.00409709
add esp, 0x18
jmp 0x48f5b5
push eax
push 0x4ef9d8
call fcn.00409709
pop ecx
pop ecx
push ebx
call dword [0x49e324]
push dword [ebp - 0xc]
call dword [0x49e26c]
pop ebx
jmp 0x48f5db
call dword [0x49e330]
push eax
push 0x4efa60
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 4]
call dword [0x49e328]
pop edi
jmp 0x48f5fa
call dword [0x49e330]
push eax
push 0x4efae0
call fcn.00409709
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x491e6d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
add ecx, edi
mov ebx, edx
mov dword [ebp + 8], ecx
cmp edi, ecx
jae 0x491ecc
push esi
movzx ecx, byte [eax + 0x100]
lea esi, [ecx + eax]
mov cl, byte [esi]
add byte [eax + 0x101], cl
movzx edx, byte [eax + 0x101]
mov dl, byte [edx + eax]
mov byte [esi], dl
movzx esi, byte [eax + 0x101]
mov byte [esi + eax], cl
movzx ecx, cl
movzx edx, dl
add edx, ecx
and edx, 0xff
mov cl, byte [edx + eax]
xor cl, byte [edi]
inc byte [eax + 0x100]
inc edi
mov byte [ebx], cl
inc ebx
cmp edi, dword [ebp + 8]
jb 0x491e81
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fe60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x43fe91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x43fe80
pop edi
mov eax, esi
pop esi
pop ebp
ret 8