joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a77
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x120
jb 0x482aa6
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x482bbf
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x482acb
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x482bae
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x482ba8
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x482ba8
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x120
jb 0x482b19
mov al, 1
jmp 0x482bc1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x482bd2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x20
jb 0x482c01
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x482d14
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x482c23
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x482d06
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x482d00
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x482d00
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x20
jb 0x482c71
mov al, 1
jmp 0x482d16
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4

Function at 0x48f7e3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c810
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5ac640]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x30]
mov dword [esi], vtable.NCompress::NLzma::CDecoder.0
push 0x5ac4e0
push eax
mov dword [esi + 4], vtable.NCompress::NLzma::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NLzma::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NLzma::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NLzma::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NLzma::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NLzma::CDecoder.6.0
call fcn.004adc09
push dword [esi + 0x24]
call fcn.006e8e37
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x48f862
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x496791
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
and dword [edi + 0x2cb0], 0
cmp dword [edi + 0x2cb8], 2
jne 0x4967d7
push 1
lea ecx, [edi + 0x38]
call fcn.0049670b
test eax, eax
je 0x4967d0
push dword [edi + 0x80]
mov ecx, edi
push dword [edi + 0x7c]
call fcn.00495f7f
jmp 0x496997
and dword [edi + 0x2cb8], 0
mov edx, dword [edi + 0x38]
mov eax, dword [edi + 0x3c]
push ebx
push 8
pop ecx
sub ecx, edx
mov dword [ebp - 0x10], edx
shr eax, cl
shr eax, 0x10
cmp dword [edi + 0x2ca0], 0x25
movzx eax, al
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x2cac]
jae 0x496813
test eax, eax
mov ebx, 0x567f34
mov ecx, 0x567f24
mov eax, 0x567f64
jmp 0x496824
test eax, eax
mov ebx, 0x567f54
mov ecx, 0x567f44
mov eax, 0x567fa0
cmove ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov ecx, ebx
xor eax, dword [ebp - 8]
mov edx, 0xff
push esi
xor esi, esi
mov cl, byte [ecx]
sar edx, cl
not edx
test eax, edx
je 0x496860
mov edi, dword [ebp - 4]
inc esi
mov edx, 0xff
mov cl, byte [esi + ebx]
mov eax, dword [edi + esi*4]
xor eax, dword [ebp - 8]
sar edx, cl
not edx
test eax, edx
jne 0x496846
mov edi, dword [ebp - 0xc]
movzx eax, byte [esi + ebx]
lea ebx, [edi + 0x38]
add eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebx], eax
call fcn.00496680
cmp esi, 9
jb 0x496916
jne 0x496892
push dword [edi + 0x80]
inc dword [edi + 0x2cb8]
push dword [edi + 0x7c]
jmp 0x49698e
and dword [edi + 0x2cb8], 0
mov ecx, edi
cmp esi, 0xe
jne 0x4968c5
push 0x567de0
call fcn.00496017
push 0xf
mov ecx, ebx
lea esi, [eax + 5]
call fcn.0049670b
add eax, 0x7fff
push esi
mov dword [edi + 0x7c], eax
push eax
jmp 0x496988
mov eax, dword [edi + 0x78]
sub eax, esi
inc eax
and eax, 3
push 0x567da8
mov ebx, dword [edi + eax*4 + 0x68]
call fcn.00496017
add eax, 2
cmp eax, 0x101
jne 0x4968f9
cmp esi, 0xa
jne 0x4968f9
xor dword [edi + 0x2cac], 1
xor eax, eax
jmp 0x496995
cmp ebx, 0x100
lea ecx, [eax + 1]
cmovb ecx, eax
mov eax, dword [edi + 0x2cc8]
dec eax
cmp ebx, eax
lea esi, [ecx + 1]
cmovb esi, ecx
jmp 0x496972
mov ecx, dword [edi + 0x2ca0]
and dword [edi + 0x2cb8], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0x2ca0], ecx
mov ecx, edi
push 0x567e88
call fcn.00496017
movzx ecx, al
mov ebx, dword [edi + ecx*4 + 0x494]
test al, al
je 0x49696f
dec dword [edi + ebx*4 + 0x1494]
mov eax, dword [edi + ecx*4 + 0x490]
inc dword [edi + eax*4 + 0x1494]
mov dword [edi + ecx*4 + 0x494], eax
mov dword [edi + ecx*4 + 0x490], ebx
add esi, 2
mov eax, dword [edi + 0x78]
push esi
push ebx
mov dword [edi + eax*4 + 0x68], ebx
mov eax, dword [edi + 0x78]
inc eax
mov dword [edi + 0x7c], ebx
and eax, 3
mov dword [edi + 0x78], eax
mov dword [edi + 0x80], esi
mov ecx, edi
call fcn.00495f7f
pop esi
pop ebx
pop edi
leave
ret
Function at 0x496a99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x101
jb 0x496ac8
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x496be1
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x496aed
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x496bd0
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x496bca
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x496bca
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x101
jb 0x496b3b
mov al, 1
jmp 0x496be3
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x496bf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x12a
jb 0x496c23
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x496d3c
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x496c48
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x496d2b
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x496d25
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x496d25
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x12a
jb 0x496c96
mov al, 1
jmp 0x496d3e
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x496d4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x13
jb 0x496d7e
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x496e91
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x496da0
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x496e83
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x496e7d
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x496e7d
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x13
jb 0x496dee
mov al, 1
jmp 0x496e93
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x496ea4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x1c
jb 0x496ed3
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x496fe6
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x496ef5
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x496fd8
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x496fd2
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x496fd2
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x1c
jb 0x496f43
mov al, 1
jmp 0x496fe8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x496ff9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x30
jb 0x497028
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x49713b
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x49704a
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x49712d
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x497127
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x497127
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x30
jb 0x497098
mov al, 1
jmp 0x49713d
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x49810b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x11
jb 0x49813a
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x49824d
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x49815c
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x49823f
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x498239
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x498239
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x11
jb 0x4981aa
mov al, 1
jmp 0x49824f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x498260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x12b
jb 0x49828f
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x4983a8
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x4982b4
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x498397
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x498391
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x498391
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x12b
jb 0x498302
mov al, 1
jmp 0x4983aa
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4
Function at 0x4983bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x8c], edx
push 0x10
pop ecx
lea edi, [ebp - 0x44]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
movzx eax, byte [edx + ecx]
inc dword [ebp + eax*4 - 0x44]
inc ecx
cmp ecx, 0x14
jb 0x4983ea
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebx + 0x44], esi
lea edi, [ebx + 0x48]
mov dword [ebx], esi
inc edx
mov dword [ebp - 0x88], esi
mov eax, dword [ebp + edx*4 - 0x44]
push 0xf
pop ecx
sub ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x88]
add ecx, eax
mov dword [ebp - 0x88], ecx
cmp ecx, 0x8000
ja 0x4984fd
mov eax, dword [edi - 4]
add eax, dword [ebp + edx*4 - 0x48]
mov dword [ebp + edx*4 - 0x84], eax
inc edx
mov dword [edi - 0x44], ecx
mov dword [edi], eax
add edi, 4
cmp edx, 0xf
jbe 0x49840c
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x40], 0x8000
movzx edx, byte [eax + esi]
test edx, edx
je 0x4984ef
mov edi, dword [ebp + edx*4 - 0x84]
movzx eax, si
mov dword [ebp - 0x88], eax
mov word [ebx + edi*2 + 0x484], ax
lea eax, [edi + 1]
mov dword [ebp + edx*4 - 0x84], eax
cmp edx, 9
ja 0x4984e9
sub edi, dword [ebx + edx*4 + 0x44]
xor eax, eax
inc eax
push 9
pop ecx
sub ecx, edx
shl eax, cl
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
shl eax, 4
or eax, edx
shl edi, cl
mov ecx, dword [ebp - 0x90]
add edi, 0x42
movzx eax, ax
mov dword [ebp - 0x88], eax
mov eax, dword [ebx + edx*4 - 4]
shr eax, 6
add edi, eax
lea edi, [ebx + edi*2]
test ecx, ecx
je 0x4984e9
mov eax, dword [ebp - 0x88]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x8c]
inc esi
cmp esi, 0x14
jb 0x49845a
mov al, 1
jmp 0x4984ff
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret 4