joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x478b45
mov eax, 0xa0100002
jmp 0x478c4c
cmp edi, 0x1f0
jle 0x478b57
mov eax, 0xa0100004
jmp 0x478c4c
mov edx, edi
and edx, 0x8000000f
jns 0x478b66
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x478b74
mov eax, 0xa0100004
jmp 0x478c4c
test edi, edi
jge 0x478b82
mov eax, 0xa0100004
jmp 0x478c4c
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov byte [ebp - 0x1b], 0x10
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.CC3260MT.DLL__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x478bdf
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x478bf4
call fcn.004784a8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5eb01a
push edx
call fcn.0047b194
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00477f30
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5eb01a
push eax
call fcn.0047b1ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x478c58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x478c85
mov eax, 0xa0100002
jmp 0x478d99
cmp edi, 0x1f0
jle 0x478c97
mov eax, 0xa0100004
jmp 0x478d99
mov edx, edi
and edx, 0x8000000f
jns 0x478ca6
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x478cb4
mov eax, 0xa0100004
jmp 0x478d99
test edi, edi
jge 0x478cc2
mov eax, 0xa0100004
jmp 0x478d99
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov byte [ebp - 0x1f], 0xf
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x478d0d
lea edx, [ebp - 0x20]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x478d27
call fcn.004784a8
mov ecx, esi
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 8], al
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x5eb01a
push ecx
call fcn.0047b194
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.00477f30
mov ecx, esi
add esp, 0xc
shl ecx, 4
mov dword [ebp - 4], eax
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x5eb01a
push ecx
call fcn.0047b1ac
mov eax, dword [ebp + 0x14]
pop ecx
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x478d88
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x479050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x479078
mov eax, 0xa0100002
jmp 0x479131
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 0xd
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov al, byte [ebp - 5]
xor al, 0
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea ecx, [ebp - 0x20]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x4790c0
call fcn.004784a8
mov byte [ebp - 8], al
mov eax, ebx
shl eax, 4
add esp, 0x1c
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5eb01a
push eax
call fcn.0047b194
pop ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.00477f30
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add esp, 0xc
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5eb01a
push eax
call fcn.0047b1ac
pop ecx
xor ecx, ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 0x10
jl 0x47911f
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4792e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x47930e
mov eax, 0xa0100002
jmp 0x4793c4
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov ebx, eax
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], bl
mov eax, ebx
xor al, 0
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], al
xor edx, edx
lea eax, [ebp - 0x16]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x47934a
lea eax, [ebp - 0x1c]
mov dl, byte [eax + 0x18]
push edx
mov edx, 5
push dword [eax + edx*4]
dec edx
jns 0x479364
call fcn.004784a8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5eb01a
push edx
call fcn.0047b194
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00477f30
mov edi, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5eb01a
push eax
call fcn.0047b1ac
mov edx, dword [ebp + 0xc]
mov eax, edi
xor bl, byte [ebp - 0x32]
pop ecx
mov byte [edx], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4793d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x4793fd
mov eax, 0xa0100002
jmp 0x479504
cmp edi, 0x1f0
jle 0x47940f
mov eax, 0xa0100004
jmp 0x479504
mov edx, edi
and edx, 0x8000000f
jns 0x47941e
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x47942c
mov eax, 0xa0100004
jmp 0x479504
test edi, edi
jge 0x47943a
mov eax, 0xa0100004
jmp 0x479504
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov byte [ebp - 0x1b], 3
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.CC3260MT.DLL__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x479497
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x4794ac
call fcn.004784a8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5eb01a
push edx
call fcn.0047b194
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00477f30
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5eb01a
push eax
call fcn.0047b1ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x479510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5eb00c], 0
jne 0x47953d
mov eax, 0xa0100002
jmp 0x47964c
cmp edi, 0x1f0
jle 0x47954f
mov eax, 0xa0100004
jmp 0x47964c
mov edx, edi
and edx, 0x8000000f
jns 0x47955e
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x47956c
mov eax, 0xa0100004
jmp 0x47964c
test edi, edi
jge 0x47957a
mov eax, 0xa0100004
jmp 0x47964c
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.CC3260MT.DLL__srand
pop ecx
call sub.CC3260MT.DLL__rand
mov byte [ebp - 0x1f], 2
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x12
jl 0x4795c5
lea eax, [ebp - 0x20]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x4795da
call fcn.004784a8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 8], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5eb01a
push edx
call fcn.0047b194
pop ecx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push ecx
push eax
push esi
call fcn.00477f30
mov edx, esi
add esp, 0xc
shl edx, 4
mov dword [ebp - 4], eax
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5eb01a
push edx
call fcn.0047b1ac
mov eax, dword [ebp + 0x14]
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
pop ecx
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x47963b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47cff4
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
cmp eax, 0x20
jbe 0x47d00d
or eax, 0xffffffff
jmp 0x47d0f0
mov edx, dword [ebp + 8]
mov dword [edx + 0xb0], eax
shr eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], 0xb7e15163
mov esi, 1
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc esi
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
cmp esi, 0x2c
jb 0x47d030
xor esi, esi
lea edx, [ebp - 0x2c]
mov eax, ecx
cmp esi, dword [ebp - 4]
jae 0x47d060
mov ecx, dword [eax]
mov dword [edx], ecx
inc esi
add edx, 4
add eax, 4
cmp esi, dword [ebp - 4]
jb 0x47d050
xor eax, eax
mov esi, eax
mov ebx, eax
mov edi, eax
cmp esi, 0x84
jae 0x47d0ee
mov eax, esi
xor edx, edx
mov ecx, 0x2c
div ecx
mov dword [ebp - 8], edx
xor edx, edx
mov eax, esi
inc esi
div dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add edx, edi
add edx, ebx
shl edx, 3
add edi, dword [ecx + eax*4]
add edi, ebx
mov eax, dword [ebp - 0xc]
shr edi, 0x1d
mov ecx, 0x20
or edx, edi
mov edi, edx
add ebx, edi
mov edx, ebx
and edx, 0x1f
sub ecx, edx
mov edx, dword [ebp + eax*4 - 0x2c]
add edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
mov ecx, ebx
add ebx, dword [ebp + eax*4 - 0x2c]
and ecx, 0x1f
shl ebx, cl
or edx, ebx
mov ecx, dword [ebp - 8]
mov ebx, edx
mov edx, dword [ebp + 8]
cmp esi, 0x84
mov dword [edx + ecx*4], edi
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2c], ebx
jb 0x47d070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485758
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
pop ebp
ret
Function at 0x487d2c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
mov ecx, 0x5d6514
push ebx
push esi
push edi
lea esi, [ebp - 0xcc]
xor edx, edx
mov dl, byte [ecx]
mov ebx, edx
and ebx, 7
mov dword [ebp - 8], ebx
sar edx, 3
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx + edx]
mov ebx, dword [ebp - 8]
and dx, word [ebx*2 + 0x5d64a4]
je 0x487d6c
mov dl, 1
jmp 0x487d6e
xor edx, edx
mov byte [esi], dl
inc eax
inc esi
inc ecx
cmp eax, 0x38
jl 0x487d45
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x5d654c
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp + edx*4 - 0x94], ecx
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x94], ecx
xor eax, eax
lea ecx, [ebp - 0x104]
mov edx, dword [ebp - 0x10]
mov esi, edx
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x1c
jge 0x487dcc
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x487dd5
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x487db6
mov edx, dword [ebp - 0x10]
mov eax, 0x1c
mov esi, edx
lea ecx, [ebp - 0xe8]
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x38
jge 0x487e02
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x487e0b
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x38
jl 0x487dec
mov ecx, dword [ebp - 0xc]
xor eax, eax
lea edx, [ebp + ecx*4 - 0x94]
mov dword [ebp - 0x14], edx
mov edx, 0x5d655c
mov ecx, dword [ebp - 8]
lea ebx, [ebp + ecx*4 - 0x94]
mov ecx, 0x5d64b4
movzx esi, byte [edx]
cmp byte [ebp + esi - 0x104], 0
je 0x487e46
mov esi, dword [ecx]
or dword [ebx], esi
movzx esi, byte [edx + 0x18]
cmp byte [ebp + esi - 0x104], 0
je 0x487e5b
mov esi, dword [ecx]
mov edi, dword [ebp - 0x14]
or dword [edi], esi
inc eax
add ecx, 4
inc edx
cmp eax, 0x18
jl 0x487e35
inc dword [ebp - 4]
inc dword [ebp - 0x10]
cmp dword [ebp - 4], 0x10
jl 0x487d84
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x94]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487ed0
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x38
push 0
push eax
call fcn.004833ac
add esp, 0xc
lea edx, [ebp - 0x104]
push 0x38
push 0
push edx
call fcn.004833ac
add esp, 0xc
lea ecx, [ebp - 0x94]
push pe_nt_image_headers32
push 0
push ecx
call fcn.004833ac
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4881bc
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x5c
push 0
push ebx
call sub.CC3260MT.DLL__memset
add esp, 0xc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret
Function at 0x488bc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5d6e9c
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.004881bc
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.004881bc
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
cmp si, 0x40
jbe 0x488c2d
push esi
push edi
push ebx
call fcn.00488468
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00488518
add esp, 8
push ebx
call fcn.004881bc
pop ecx
jmp 0x488c3e
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.CC3260MT.DLL__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x488c43
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00488468
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x488c60
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.00488468
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488cb8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5d6edc
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.004881bc
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.004881bc
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
cmp si, 0x40
jbe 0x488d25
push esi
push edi
push ebx
call fcn.00488a7c
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00488b2c
add esp, 8
push ebx
call fcn.004881bc
pop ecx
jmp 0x488d36
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.CC3260MT.DLL__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x488d3b
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00488a7c
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x488d58
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.00488a7c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push 0x10
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.00488f88
add esp, 0xc
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.00488f88
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov edx, eax
mov eax, dword [ebp + 8]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 0x10
jb 0x488ef1
xor eax, eax
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x30]
mov al, byte [eax + 0x5d6f1c]
inc ecx
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
cmp ecx, 0x30
jb 0x488f09
lea edx, [esi + eax]
inc esi
and edx, 0xff
cmp esi, 0x12
mov eax, edx
jb 0x488f04
push 0x10
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00488f88
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 0xc
xor esi, esi
mov al, byte [edx + 0xf]
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov edx, dword [ebp + 0x10]
xor ebx, ebx
inc esi
mov bl, byte [edx]
inc edx
xor eax, ebx
mov al, byte [eax + 0x5d6f1c]
xor byte [ecx], al
mov al, byte [ecx]
inc ecx
and eax, 0xff
cmp esi, 0x10
jb 0x488f54
push 0x30
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.00488fb0
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488fd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x48ce98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov eax, dword [ebp + 8]
test eax, eax
jge 0x48ceb2
neg eax
mov dword [0x5d71c0], eax
mov eax, 1
mov edx, dword [0x5d71c0]
xor ecx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x5d71d4
mov dword [ebp - 0x10], 0x5d71c4
mov dword [ebp - 0xc], eax
mov ecx, eax
mov edx, dword [ebp - 0x10]
xor ecx, dword [edx]
mov edx, ecx
mov eax, ecx
shr edx, 0x10
and eax, 0xffff
mov ebx, eax
mov ecx, edx
imul ecx, edx
imul ebx, eax
imul edx
not ecx
add ebx, ecx
mov edx, dword [ebp - 0xc]
mov ecx, ebx
and ebx, 0xffff
shl ebx, 0x10
shr ecx, 0x10
or ecx, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, dword [ebx]
add ecx, eax
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], edx
inc dword [ebp - 8]
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 4
mov eax, ecx
jb 0x48cece
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48cfe8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, 0x5ef4b4
lea esi, [ebp - 0x24]
mov eax, 0x5d8820
call fcn.0057c5c8
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebx + 0x70]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x64]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x60]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x5c]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x58]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x54]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x4c]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x40]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x3c]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x38]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x34]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x30]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x2c]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x28]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x24]
mov edx, 2
call fcn.0058fb04
dec dword [esi + 0x1c]
lea eax, [ebx + 0x20]
mov edx, 2
call fcn.0058fb04
mov ecx, dword [esi]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48dd14
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
push edi
cmp dword [0x5d890c], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, edi
jne 0x48dd4a
push 0x5d98c4
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x5d98d1
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x5d890c], eax
cmp dword [0x5d890c], 0
je 0x48dd60
mov eax, dword [ebp + 0xc]
push eax
push edi
call dword [0x5d890c]
jmp 0x48ddb0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x48dd70
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
jne 0x48dd69
xor ecx, ecx
mov eax, esi
mov esi, eax
cmp ecx, dword [ebp + 0xc]
jge 0x48ddb0
lea edx, [ecx + 1]
mov eax, ebx
mov edi, edx
xor edx, edx
div edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov edx, ecx
and edx, 0x80000003
jns 0x48dda4
dec edx
or edx, 0xfffffffc
inc edx
mov al, byte [eax + edx]
inc ecx
mov byte [esi], al
inc esi
cmp ecx, dword [ebp + 0xc]
jl 0x48dd84
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret