joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e789
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e792
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e798
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e79f
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e7a8
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x44e7b1
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop eax
cmp dword [ebp + 0x14], eax
je 0x44e6d2
cmp dword [ebp + 0x14], 0xc
je 0x44e6d2
cmp dword [ebp + 0x14], 8
je 0x44e6d2
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor edi, edi
add edx, 0xfffffff8
mov dword [ebx], eax
mov dword [ebp - 0x108], edi
cmp edx, edi
jl 0x44e753
add edx, 8
shr edx, 3
mov eax, edx
shl eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 1]
movzx ecx, byte [eax]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 2]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ecx, esi
movzx esi, byte [eax + 5]
mov dword [ebp + edi*4 - 0x104], ecx
movzx ecx, byte [eax + 4]
shl esi, 8
or ecx, esi
movzx esi, byte [eax + 6]
shl esi, 0x10
or ecx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ecx, esi
add eax, 8
mov dword [ebp + edi*4 - 0x100], ecx
add edi, 2
dec edx
jne 0x44e6fd
jmp 0x44e756
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
sub edx, dword [ebp - 0x108]
je 0x44e7c7
and ecx, 7
add eax, ecx
xor esi, esi
xor edx, edx
dec ecx
cmp ecx, 7
ja case.default.0x44e772
jmp dword [ecx*4 + 0x44e88e]
dec eax
movzx esi, byte [eax]
shl esi, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or esi, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or esi, ecx
dec eax
movzx ecx, byte [eax]
or esi, ecx
dec eax
movzx edx, byte [eax]
shl edx, 0x18
dec eax
movzx ecx, byte [eax]
shl ecx, 0x10
or edx, ecx
dec eax
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
movzx eax, byte [eax - 1]
or edx, eax
mov eax, edi
mov dword [ebp + eax*4 - 0x104], edx
mov dword [ebp + eax*4 - 0x100], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
add eax, 3
cdq
and edx, 3
add eax, edx
xor edx, edx
lea ecx, [ecx + ecx + 2]
sar eax, 2
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebx + 4], 0xb7e15163
cmp ecx, edx
jle 0x44e809
mov esi, dword [ebx + edx*4]
sub esi, 0x61c88647
mov dword [ebx + edx*4 + 4], esi
inc edx
cmp edx, ecx
jl 0x44e7f7
cmp ecx, eax
jg 0x44e80f
mov ecx, eax
imul ecx, ecx, 3
xor esi, esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x108], esi
test ecx, ecx
jle 0x44e87e
mov dword [ebp - 0x10c], ecx
mov edi, dword [ebp - 0x108]
lea ecx, [edx + esi]
add ecx, dword [ebx + eax*4 + 4]
lea edi, [ebp + edi*4 - 0x104]
rol ecx, 3
mov esi, ecx
mov dword [ebx + eax*4 + 4], ecx
lea ecx, [edx + esi]
add edx, esi
add edx, dword [edi]
inc eax
rol edx, cl
mov dword [edi], edx
cmp eax, dword [ebp - 0x110]
jl 0x44e85b
xor eax, eax
inc dword [ebp - 0x108]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
jl 0x44e876
and dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x44e828
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x4507de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
jle 0x450807
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x59d350]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [ebp + 8]
cmp dword [ebp + 8], 0
jg 0x4507e9
pop esi
pop ebp
ret
Function at 0x458482
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
cmp dword [ecx + 0x1c], edx
jbe 0x458563
push esi
lea eax, [ecx + 0x32]
push edi
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x6012a8]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x600aa8]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x600ea8]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x6006a8]
add eax, 0x10
mov dword [eax - 0x12], esi
movzx esi, byte [eax - 0xb]
mov esi, dword [esi*4 + 0x6012a8]
movzx edi, byte [eax - 0xc]
xor esi, dword [edi*4 + 0x600ea8]
movzx edi, byte [eax - 0xd]
xor esi, dword [edi*4 + 0x600aa8]
movzx edi, byte [eax - 0xe]
xor esi, dword [edi*4 + 0x6006a8]
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x6012a8]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x600ea8]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x600aa8]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x6006a8]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x6012a8]
xor esi, dword [edi*4 + 0x600ea8]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x600aa8]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x6006a8]
inc edx
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x1c]
jb 0x458499
pop edi
pop esi
pop ebp
ret
Function at 0x458d1f
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x45942a
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x1c]
push edi
xor edi, edi
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x10c], edi
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jl 0x45946b
xor esi, esi
mov eax, esi
cdq
idiv dword [ebp - 0x108]
mov eax, dword [ebp - 0x114]
lea ecx, [ebp + esi - 0x104]
movzx ebx, byte [ecx]
movzx eax, byte [edx + eax]
add eax, ebx
add edi, eax
and edi, 0x800000ff
jns 0x4594ad
dec edi
or edi, 0xffffff00
inc edi
lea eax, [ebp + edi - 0x104]
mov dl, byte [eax]
inc esi
mov byte [ecx], dl
mov byte [eax], bl
cmp esi, 0x100
jl 0x45947c
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x459557
mov edi, dword [ebp - 0x118]
mov edx, dword [ebp + 0x14]
sub edx, edi
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
and eax, 0x800000ff
jns 0x4594f4
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
lea eax, [ebp + eax - 0x104]
movzx ecx, byte [eax]
add esi, ecx
and esi, 0x800000ff
jns 0x45951c
dec esi
or esi, 0xffffff00
inc esi
mov dword [ebp - 0x10c], esi
lea esi, [ebp + esi - 0x104]
mov bl, byte [esi]
mov byte [eax], bl
mov byte [esi], cl
movzx eax, byte [eax]
add eax, ecx
and eax, 0x800000ff
jns 0x459542
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax - 0x104]
xor al, byte [edx + edi]
mov byte [edi], al
inc edi
dec dword [ebp - 0x108]
jne 0x4594df
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret
Function at 0x460754
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045965b
lea eax, [ebp - 0x84]
push eax
push 0
push 0x5caa8b
push dword [ebp + 8]
call fcn.0045965b
lea eax, [ebp - 0xdc]
call fcn.00458d1f
lea eax, [ebp - 0x84]
push eax
push 0x20
pop edi
mov eax, edi
lea ecx, [ebp - 0xdc]
call fcn.004604bb
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0xdc]
call fcn.0046041f
add esp, 0x28
push 0x32
pop ebx
lea eax, [ebp - 0xdc]
call fcn.00458d1f
lea eax, [ebp - 0x14]
push eax
push 0x10
pop eax
lea ecx, [ebp - 0xdc]
call fcn.004604bb
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0xdc]
call fcn.0046041f
dec ebx
pop ecx
pop ecx
jne 0x4607d2
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004fbb10
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x14]
xor cl, bl
mov byte [ebp + eax - 0x44], cl
inc eax
cmp eax, 0x10
jl 0x460816
lea eax, [ebp - 0x34]
push eax
push edi
push eax
push 0x10
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.0045942a
add esp, 0x18
inc ebx
cmp ebx, 0x14
jl 0x460814
lea eax, [ebp - 0xdc]
call fcn.00458d1f
lea eax, [ebp - 0x64]
push eax
mov eax, edi
lea ecx, [ebp - 0xdc]
call fcn.004604bb
lea eax, [ebp - 0x34]
push eax
mov eax, edi
lea ecx, [ebp - 0xdc]
call fcn.004604bb
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0xdc]
call fcn.0046041f
add esp, 0xc
push 0x32
pop edi
lea eax, [ebp - 0xdc]
call fcn.00458d1f
lea eax, [ebp - 0x14]
push eax
push 0x10
pop eax
lea ecx, [ebp - 0xdc]
call fcn.004604bb
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0xdc]
call fcn.0046041f
dec edi
pop ecx
pop ecx
jne 0x460885
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xe0]
call fcn.004fbb10
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb958
leave
ret