joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d59e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, esi
xor dword [eax], 0x41dfac36
inc ebx
add eax, 4
cmp ebx, 4
jb 0x47d5ae
mov edx, edi
mov eax, dword [esi + 0x10]
shl edx, 3
add dword [esi + 0x10], edx
shr eax, 3
mov ecx, dword [esi + 0x10]
and eax, 0x3f
cmp ecx, edx
jae 0x47d5d8
inc dword [esi + 0x14]
mov edx, edi
mov ebx, 0x40
shr edx, 0x1d
sub ebx, eax
add dword [esi + 0x14], edx
cmp ebx, edi
ja 0x47d629
push ebx
add eax, esi
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.0047e22b
add esp, 0xc
lea eax, [esi + 0x18]
push eax
push esi
call fcn.0047d6c1
add esp, 8
jmp 0x47d61e
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push esi
call fcn.0047d6c1
add esp, 8
add ebx, 0x40
lea ecx, [ebx + 0x3f]
cmp edi, ecx
ja 0x47d60c
xor eax, eax
jmp 0x47d62b
xor ebx, ebx
sub edi, ebx
add esi, eax
push edi
mov edx, dword [ebp + 0xc]
add edx, ebx
add esi, 0x18
push edx
push esi
call fcn.0047e22b
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x47e26e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x52
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0x43
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0x36
mov eax, dword [ebp + 0xc]
mov byte [eax + 3], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], 0xb8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [0x4a2c44]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 0xc]
xor dword [ecx + 8], 0x339effab
mov ebx, 1
mov eax, dword [ebp + 0xc]
add eax, 8
mov edx, dword [eax]
inc ebx
mov dword [eax + 4], edx
mov ecx, dword [0x4a2c48]
xor ecx, 0x339effab
add dword [eax + 4], ecx
add eax, 4
cmp ebx, 0x2b
jle 0x47e2ca
xor eax, eax
mov edi, eax
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
cmp dword [ebp - 8], 0x2c
jle 0x47e2ff
mov eax, dword [ebp - 8]
jmp 0x47e304
mov eax, 0x2c
lea edx, [eax + eax*2]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jg 0x47e37e
push 3
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ebx*4 + 8]
add esi, edi
push esi
call fcn.0047e5e1
mov edx, dword [ebp + 0xc]
mov esi, eax
add esp, 8
mov dword [edx + ebx*4 + 8], eax
lea edx, [edi + esi]
push edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
add edx, esi
add edi, edx
push edi
call fcn.0047e5e1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edi, eax
add esp, 8
mov dword [ecx + edx*4], eax
lea eax, [ebx + 1]
cdq
mov ecx, 0x2c
idiv ecx
mov eax, dword [ebp - 0xc]
mov ebx, edx
inc eax
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jle 0x47e319
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e4b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0x10], 0xf
je 0x47e4cb
mov eax, 1
jmp 0x47e5da
cmp dword [ebp + 0x10], 0
je 0x47e5d8
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
add dword [ebp + 0xc], 4
sub dword [ebp + 0x10], 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub edi, dword [ecx + 0xb4]
sub ebx, dword [eax + 0xb0]
mov dword [ebp - 0x10], 0x14
mov edx, dword [ebp + 8]
lea ecx, [edx + 0xac]
mov dword [ebp - 0x14], ecx
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov edi, esi
mov esi, eax
push 5
mov eax, dword [ebp - 0xc]
add eax, eax
inc eax
imul dword [ebp - 0xc]
push eax
call fcn.0047e5e1
mov edx, esi
add esp, 8
add edx, edx
mov dword [ebp - 8], eax
inc edx
push 5
imul edx, esi
push edx
call fcn.0047e5e1
add esp, 8
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub edi, dword [ecx]
push edi
call fcn.0047e604
add esp, 8
xor eax, dword [ebp - 8]
mov edi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
sub ebx, dword [eax - 4]
push ebx
call fcn.0047e604
xor eax, dword [ebp - 4]
dec dword [ebp - 0x10]
add dword [ebp - 0x14], 0xfffffff8
add esp, 8
mov ebx, eax
cmp dword [ebp - 0x10], 0
jg 0x47e525
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
sub dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
sub esi, dword [eax + 8]
mov dword [edx], ebx
add dword [ebp + 0x14], 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
add dword [ebp + 0x14], 4
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
add dword [ebp + 0x14], 4
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
add dword [ebp + 0x14], 4
cmp dword [ebp + 0x10], 0
jne 0x47e4d5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4830b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov byte [esp], 0x4f
mov byte [esp + 2], 0x4c
mov byte [esp + 4], 0x44
mov byte [esp + 6], 0x47
mov byte [esp + 8], 0x45
mov byte [esp + 0xa], 0x45
mov byte [esp + 1], 0x4c
mov byte [esp + 3], 0x59
mov byte [esp + 5], 0x42
mov byte [esp + 7], 0x2e
mov byte [esp + 9], 0x58
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xe], 0x50
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x12], 0x53
mov byte [esp + 0x14], 0x45
mov byte [esp + 0x16], 0x45
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x15], 0x58
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x1a], 0x32
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x19], 0x33
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x21], 0x58
mov byte [esp + 0x23], 0
push 0
push 2
call fcn.00479dd2
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48318b
xor eax, eax
jmp 0x4832a3
mov dword [esp + 0x24], 0x128
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00479e80
add esp, 8
test eax, eax
jne 0x4831b3
push ebx
call fcn.00479b5f
pop ecx
xor eax, eax
jmp 0x4832a3
call fcn.00479cc2
cmp eax, dword [esp + 0x2c]
jne 0x4831c2
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00479f06
add esp, 8
test eax, eax
jne 0x4831b3
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00479e80
add esp, 8
test eax, eax
jne 0x4831f4
push ebx
call fcn.00479b5f
pop ecx
xor eax, eax
jmp 0x4832a3
cmp esi, dword [esp + 0x2c]
jne 0x483281
lea edx, [esp + 0x48]
push edx
call fcn.00479511
pop ecx
lea ecx, [esp + 0x48]
push ecx
call fcn.004794ee
pop ecx
push esp
call fcn.00479511
pop ecx
lea eax, [esp + 0xc]
push eax
call fcn.00479511
pop ecx
lea edx, [esp + 0x18]
push edx
call fcn.00479511
pop ecx
push 0xc
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.004794a5
add esp, 0xc
mov edi, eax
push 0xc
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004794a5
add esp, 0xc
mov ebp, eax
push 0xd
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004794a5
add esp, 0xc
test edi, edi
je 0x48327d
test ebp, ebp
je 0x48327d
test eax, eax
jne 0x483281
xor eax, eax
jmp 0x4832a3
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00479f06
add esp, 8
test eax, eax
jne 0x4831f4
push ebx
call fcn.00479b5f
pop ecx
mov eax, 1
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4833d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4833e8
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4833fc
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret
Function at 0x489e7a
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
cmp dword [ebp + 0xc], 0x40
jle 0x489ed3
lea eax, [ebp - 0xe8]
push eax
call fcn.0047d573
pop ecx
lea edx, [ebp - 0xe8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call fcn.0047d59e
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
lea eax, [ebp - 0x90]
push eax
call fcn.0047d647
add esp, 8
lea edx, [ebp - 0x90]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], 0x10
xor eax, eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x80]
xor ebx, ebx
mov byte [edx], bl
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x489edb
xor eax, eax
lea esi, [ebp - 0x40]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jge 0x489f08
mov bl, byte [edx]
mov byte [ecx], bl
mov byte [esi], bl
inc eax
inc esi
inc ecx
inc edx
cmp eax, dword [ebp + 0xc]
jl 0x489ef9
xor eax, eax
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x40]
jmp 0x489f13
xor byte [edx], 0x36
xor byte [ecx], 0x5c
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x489f10
lea eax, [ebp - 0xe8]
push eax
call fcn.0047d573
pop ecx
push 0x40
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.0047d59e
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea edx, [ebp - 0xe8]
xor eax, eax
jmp 0x489f53
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x489f50
lea eax, [ebp - 0xe8]
push eax
call fcn.0047d573
pop ecx
push 0x40
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.0047d59e
mov edx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
lea ecx, [edx + 0x10]
lea edx, [ebp - 0xe8]
jmp 0x489f96
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x489f93
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [0x4b3180]
xor al, al
push str.Kernel32.dll
mov byte [0x4ae7e1], 0x6c
mov byte [0x4ae7e3], 0x32
mov byte [0x4ae7e2], 0x33
mov byte [0x4ae7e4], 0x2e
mov byte [0x4ae7df], 0x6e
mov byte [0x4ae7e6], 0x6c
mov byte [0x4ae7e0], 0x65
mov byte [0x4ae7e8], al
mov byte [0x4ae7e5], 0x64
mov byte [0x4ae7e7], 0x6c
mov byte [str.Kernel32.dll], 0x4b
mov byte [0x4ae7de], 0x72
mov byte [0x4ae7dd], 0x65
mov byte [0x4ae808], 0x70
mov byte [0x4ae809], 0x69
mov byte [0x4ae80a], 0x33
mov byte [0x4ae80b], 0x32
mov byte [str.Advapi32], 0x41
mov byte [0x4ae805], 0x64
mov byte [0x4ae806], 0x76
mov byte [0x4ae807], 0x61
mov byte [0x4ae80c], al
mov byte [0x4ae7ee], 0x64
mov byte [0x4ae7ef], 0x6c
mov byte [str.ntdll], 0x6e
mov byte [0x4ae7ed], 0x74
mov byte [0x4ae7f0], 0x6c
mov byte [0x4ae7f1], al
mov byte [0x4ae7fc], 0x33
mov byte [0x4ae7fd], 0x32
mov byte [str.User32], 0x55
mov byte [0x4ae7f9], 0x73
mov byte [0x4ae7fa], 0x65
mov byte [0x4ae7fb], 0x72
mov byte [0x4ae7fe], al
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6e
mov byte [ebp - 4], al
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x64
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x6c
mov byte [ebp - 2], al
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 6], 0x65
call esi
push str.ntdll
mov dword [ebp - 0x20], eax
call esi
push str.User32
mov dword [ebp - 0x24], eax
call esi
push str.Advapi32
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call dword [0x4b317c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00492cd7
pop esi
leave
ret

Function at 0x48bcfd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
jmp 0x48bd12
push 2
call fcn.00490543
xor esi, esi
lea edx, [ebp - 0x400]
push 8
mov ecx, esi
pop edi
test cl, 1
je 0x48bd34
shr ecx, 1
xor ecx, eax
jmp 0x48bd36
shr ecx, 1
dec edi
jne 0x48bd29
mov dword [edx], ecx
inc esi
add edx, 4
cmp esi, 0x100
jl 0x48bd24
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x48bd77
lea edx, [ecx + 1]
mov ecx, dword [ebp + 8]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [ebp + esi*4 - 0x400]
xor eax, esi
inc ecx
dec edx
jne 0x48bd5a
pop edi
pop esi
not eax
leave
ret
Function at 0x48bd7d
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov eax, ebx
push 4
cdq
pop ecx
mov esi, 0x9ac4512b
idiv ecx
xor edi, edi
mov dword [ebp - 4], esi
test eax, eax
jle 0x48bdaf
mov ecx, dword [ebp + 0x10]
mov edi, eax
xor dword [ecx], esi
add ecx, 4
dec eax
jne 0x48bda7
mov eax, ebx
push 4
cdq
pop esi
xor ecx, ecx
idiv esi
mov esi, edx
test esi, esi
jle 0x48bdd1
mov eax, dword [ebp + 0x10]
lea eax, [eax + edi*4]
mov dl, byte [ebp + ecx - 4]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, esi
jl 0x48bdc5
cmp ebx, 0x40
jle 0x48be0e
lea eax, [ebp - 0x154]
push eax
call fcn.00490732
push ebx
lea eax, [ebp - 0x154]
push dword [ebp + 0x10]
push eax
call fcn.0049075d
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004907fb
add esp, 0x18
lea eax, [ebp - 0x24]
mov dword [ebp + 0x10], eax
push 0x10
pop ebx
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0xfc]
rep stosd dword es:[edi], eax
push 0x10
lea edi, [ebp - 0x64]
pop ecx
xor edx, edx
test ebx, ebx
rep stosd dword es:[edi], eax
jle 0x48be46
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x64]
sub esi, eax
lea eax, [ebp + edx - 0x64]
inc edx
cmp edx, ebx
mov cl, byte [esi + eax]
mov byte [ebp + edx - 0xfd], cl
mov byte [eax], cl
jl 0x48be31
xor eax, eax
xor byte [ebp + eax - 0xfc], 0x36
xor byte [ebp + eax - 0x64], 0x5c
inc eax
cmp eax, 0x40
jl 0x48be48
lea eax, [ebp - 0xbc]
push eax
call fcn.00490732
lea eax, [ebp - 0xfc]
push 0x40
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0049075d
push dword [ebp + 0xc]
lea eax, [ebp - 0xbc]
push dword [ebp + 8]
push eax
call fcn.0049075d
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004907fb
lea eax, [ebp - 0xbc]
push eax
call fcn.00490732
lea eax, [ebp - 0x64]
push 0x40
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0049075d
lea eax, [ebp - 0x14]
push 0x10
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0049075d
add esp, 0x40
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004907fb
mov edi, dword [ebp + 0x18]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48bf60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x40
push edi
push esi
call fcn.0048c7e2
add esp, 0xc
cmp word [esi], 0x5a4d
je 0x48bf83
push 1
pop eax
jmp 0x48bfbe
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x48bf7e
mov esi, dword [ebp + 0x10]
add eax, edi
push pe_nt_image_headers32
push eax
push esi
call fcn.0048c7e2
add esp, 0xc
cmp dword [esi], 0x4550
jne 0x48bf7e
cmp word [esi + 4], 0x14c
jne 0x48bf7e
test byte [esi + 0x17], 0x10
jne 0x48bf7e
push 0x10
pop eax
cmp eax, dword [esi + 0x74]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret
Function at 0x48c806
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
xor esi, esi
push esi
push dword [ebp + 0xc]
call dword [0x4b31ec]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x48c903
push esi
push dword [ebp + 8]
call dword [0x4b31d4]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x48c903
push ebx
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.004930b0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004945aa
pop ecx
mov dword [0x4ae91c], esi
pop ecx
mov dword [ebp - 0x418], 0x646c6f47
mov dword [ebp - 0x414], 0x6f736e65
mov byte [ebp - 0x410], 0x66
xor eax, eax
xor byte [ebp + eax - 0x418], bl
inc eax
cmp eax, 9
jl 0x48c877
mov esi, dword [0x4b31cc]
lea eax, [ebp - 0x418]
push 0xa
push eax
push dword [ebp - 8]
mov byte [ebp - 0x40f], bl
call esi
mov edi, dword [0x4b31d0]
mov ebx, 0x400
lea eax, [ebp - 0x418]
push ebx
push eax
push dword [ebp - 4]
call edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x48c8e8
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00493cd3
pop ecx
lea eax, [ebp - 0x418]
pop ecx
push dword [ebp + 0xc]
push eax
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x418]
push ebx
push eax
push dword [ebp - 4]
jmp 0x48c8b4
push dword [ebp - 8]
mov esi, dword [0x4b31c4]
call esi
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call dword [0x4b31b8]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x490187
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push esi
push edi
push edx
push ecx
push ebx
push eax
mov eax, dword [0x4af9a0]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x4af9a4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x4af9a8]
mov dword [ebp - 0x28], edx
mov eax, dword [0x4af9ac]
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov cl, byte [0x4af9a0]
xor ecx, 0x7e
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
test edx, edx
jne 0x4901d7
mov byte [ebp - 0xc], 0x7e
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + 4], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x20]
cmp dword [eax*8 + 0x4ae478], 0
je 0x490253
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx*8 + 0x4ae478]
jne 0x490248
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax*8 + 0x4ae47c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x490246
mov edx, dword [ebp - 0x20]
mov dword [edx*8 + 0x4ae47c], 1
jmp 0x490253
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x490202
cmp dword [ebp - 8], 0
jne 0x49027b
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [ecx*8 + 0x4ae478], edx
mov eax, dword [ebp - 0x20]
mov dword [eax*8 + 0x4ae47c], 1
cmp dword [ebp - 0x14], 0
jne 0x490351
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x4ae150]
push eax
push 0x4ae058
mov ecx, dword [0x4ae8b8]
push ecx
call fcn.0048e9f5
add esp, 0x18
cmp dword [ebp - 0x1c], 8
jb 0x4902fe
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, 8
div ecx
mov eax, dword [ebp - 0x1c]
sub eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
jmp 0x4902d5
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
shr edx, 3
cmp dword [ebp - 0x20], edx
jae 0x4902fe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax*8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00494def
add esp, 8
jmp 0x4902cc
mov dword [ebp - 0x20], 0
jmp 0x490310
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
jae 0x49032d
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x20]
mov dl, byte [ecx]
xor dl, byte [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x20]
mov byte [eax], dl
jmp 0x490307
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x4ae150]
push eax
push 0x4ae058
mov ecx, dword [0x4ae8b8]
push ecx
call fcn.0048e9f5
add esp, 0x18
pop eax
pop ebx
pop ecx
pop edx
pop edi
pop esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49035e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push esi
push edi
push edx
push ecx
push ebx
push eax
mov eax, dword [0x4af9a0]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x4af9a4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x4af9a8]
mov dword [ebp - 0x28], edx
mov eax, dword [0x4af9ac]
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov cl, byte [0x4af9a0]
xor ecx, 0x7e
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
test edx, edx
jne 0x4903ae
mov byte [ebp - 0xc], 0x7e
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + 4], eax
mov eax, dword [ebp - 0x10]
sub eax, 0xa
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x20]
cmp dword [ecx*8 + 0x4ae478], 0
je 0x490436
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx*8 + 0x4ae478]
jne 0x49042b
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx*8 + 0x4ae47c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x490429
mov eax, dword [ebp - 0x20]
mov dword [eax*8 + 0x4ae47c], 0
jmp 0x490436
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x4903e5
cmp dword [ebp - 8], 0
jne 0x49045e
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [edx*8 + 0x4ae478], eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx*8 + 0x4ae47c], 0
cmp dword [ebp - 0x14], 0
je 0x490536
push 1
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x4ae150]
push ecx
push 0x4ae058
mov edx, dword [0x4ae8b8]
push edx
call fcn.0048e9f5
add esp, 0x18
mov dword [ebp - 0x20], 0
jmp 0x49049f
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x1c]
jae 0x4904bc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x20]
mov al, byte [edx]
xor al, byte [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x20]
mov byte [ecx], al
jmp 0x490496
cmp dword [ebp - 0x1c], 8
jb 0x490511
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, 8
div ecx
mov eax, dword [ebp - 0x1c]
sub eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
jmp 0x4904e8
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
shr edx, 3
cmp dword [ebp - 0x20], edx
jae 0x490511
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax*8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00494dda
add esp, 8
jmp 0x4904df
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x4ae150]
push ecx
push 0x4ae058
mov edx, dword [0x4ae8b8]
push edx
call fcn.0048e9f5
add esp, 0x18
pop eax
pop ebx
pop ecx
pop edx
pop edi
pop esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret