joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4442b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [esi + 0x608]
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], edx
mov ebx, eax
test edi, edi
jg 0x4443d1
cmp dword [esi + 0x10], 0
jle 0x444384
push 0x5dc
push ecx
push dword [esi + 0x610]
xor edi, edi
call fcn.00446160
add esp, 0xc
mov dword [esi + 0x608], eax
test eax, eax
jg 0x44431f
push eax
push dword [esi + 0x610]
call fcn.00445b50
mov edi, eax
add esp, 8
cmp edi, 2
jne 0x44431f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 4]
cmp edx, ecx
ja 0x444343
jb 0x444332
cmp eax, ebx
jae 0x444343
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
sub eax, ebx
sbb edx, ecx
test edx, edx
ja 0x4443b8
jb 0x444352
cmp eax, dword [esi + 0x1c]
ja 0x4443b8
mov eax, dword [esi + 0x28]
test eax, eax
je 0x44435e
cmp byte [eax], 0
jne 0x444378
mov eax, dword [esi + 0x608]
test eax, eax
jg 0x444374
lea ecx, [esi + 0x2c]
cmp edi, 2
je 0x4442e1
test edi, edi
je 0x4443af
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa
mov ecx, esi
call fcn.00443dc0
cmp eax, 0xffffffff
je 0x444378
test eax, eax
je 0x4443c6
push 0
push 0x5dc
lea eax, [esi + 0x2c]
push eax
push dword [esi + 0x18]
call sub.WSOCK32.dll_recv
mov dword [esi + 0x608], eax
test eax, eax
jle 0x444378
jmp 0x4442bb
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edi, dword [ebp + 0xc]
cmovg edi, dword [ebp + 0xc]
push edi
push ecx
push dword [ebp + 8]
call fcn.004de9c0
mov ecx, dword [esi + 0x608]
lea eax, [esi + 0x2c]
sub ecx, edi
push ecx
lea ecx, [esi + 0x2c]
add ecx, edi
push ecx
push eax
call fcn.004de9c0
add esp, 0x18
mov eax, edi
sub dword [esi + 0x608], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f7f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.004dd690
mov eax, dword [0x60aca0]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x45f856
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.0050bd60
add esp, 0xc
cmp edi, 0x40
jbe 0x45f872
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.0050bd60
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x45f899
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.004def40
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x45f98f
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x24], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x24]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x28]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x45f910
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x45f9ca
mov ebp, dword [esp + 0x30]
nop dword [eax]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x45f9a0
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dcc5c
add esp, 0xa8
ret
Function at 0x460440
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004dd690
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x46048a
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x46047d
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x46048f
cmp ebp, dword [esi + 4]
ja 0x460474
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x4604e2
cmp dword [edi + 0x88], 0
jne 0x4604e2
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x58b0a0
push eax
call fcn.0050b9f0
add esp, 0xc
test eax, eax
jne 0x4604d5
test bl, 1
jne 0x4604d5
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x4604e2
test ebx, ebx
je 0x4604e2
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call fcn.00445c90
add esp, 4
test eax, 0x200000
je 0x46050e
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
lea ecx, [ebx + ebp]
mov ebp, dword [esi + 4]
mov edx, ebp
mov dword [esp + 0x14], ebp
sub edx, ecx
mov eax, ebp
xor edx, ecx
xor eax, ecx
or edx, eax
mov ecx, 0xff
xor edx, ebp
lea eax, [ebp - 1]
shr edx, 0x1f
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
xor edi, edi
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x460599
mov ecx, ebx
dec ebp
shr ecx, 0x1f
add ebp, dword [esi + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov al, byte [esp + 0x28]
lea ebp, [ebp - 1]
mov edx, ebx
mov ecx, edi
sub edx, edi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc edi
or dl, al
movzx eax, byte [ebp + 1]
xor dl, byte [esp + 0x28]
xor eax, ebx
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
and ecx, eax
not ecx
and edx, ecx
mov dword [esp + 0x1c], edx
cmp edi, esi
jb 0x460556
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edx
movzx eax, dl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebx + 1]
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
pop ebx
pop edi
mov dword [esi + 4], ebp
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
add esp, 8
ret
Function at 0x4609b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.004dd690
push ebx
push esi
push edi
lea eax, [esp + 0x14]
xor esi, esi
push eax
lea eax, [esp + 0x10]
xor edi, edi
push eax
push esi
call fcn.00450bc0
add esp, 0xc
test eax, eax
je 0x460bbb
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
shl eax, 0xa
test ebx, eax
je 0x4609ec
inc edi
lea eax, [esp + 0x14]
inc esi
push eax
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00450bc0
add esp, 0xc
test eax, eax
jne 0x4609e0
test edi, edi
je 0x460bbb
mov ecx, dword [esp + 0x50]
mov eax, ecx
cdq
idiv edi
push ebp
mov ebp, dword [esp + 0x58]
mov esi, eax
xor eax, eax
mov dword [esp + 0x14], esi
cmp edi, 1
mov edi, dword [esp + 0x60]
push edi
push eax
cmove ecx, eax
push ebp
mov dword [esp + 0x60], ecx
call fcn.004def40
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00450bc0
add esp, 0x18
test eax, eax
je 0x460b86
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x24], eax
je 0x460b62
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x460b93
push edi
push ebx
push dword [esp + 0x54]
mov eax, dword [esp + 0x60]
push dword [esp + 0x54]
and eax, 1
push dword [esp + 0x54]
add eax, esi
mov esi, dword [esp + 0x64]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
push esi
push ecx
call fcn.00460be0
add esp, 0x3c
test eax, eax
je 0x460bb1
add esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x50], esi
test edi, edi
jle 0x460b5e
cmp edi, 0x20
jb 0x460b3b
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x460af0
cmp edx, ebx
jae 0x460b3b
mov eax, edi
and eax, 0x8000001f
jns 0x460afe
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x460b10
cmp ecx, edi
jge 0x460b5e
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
nop word [eax + eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x460b50
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.00450bc0
add esp, 0xc
test eax, eax
jne 0x460a60
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.0050f140
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.0050f140
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x472c10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [eax + 4], 0
je 0x472c6f
push edi
mov edi, dword [eax + 0x28]
test edi, edi
je 0x472c6e
push ebx
call fcn.00472890
xor ebx, ebx
test edi, edi
je 0x472c6d
push esi
lea esi, [eax + 1]
nop word [eax + eax]
lea ecx, [edi - 1]
xor edx, edx
mov eax, 0xff
lea esi, [esi + 4]
div ecx
movzx ecx, bl
inc ebx
movzx eax, al
imul eax, ecx
mov byte [esi - 3], al
mov byte [esi - 4], al
mov byte [esi - 5], al
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x28]
cmp ebx, edi
jb 0x472c40
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4809e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x480a18
cmp dword [ebp + 0xc], 0xf0
jae 0x480a08
push eax
call fcn.00486540
push 2
call fcn.00486490
add esp, 8
mov dword [esi], eax
push 0xf0
push 0
push eax
call fcn.004def40
add esp, 0xc
pop esi
pop ebp
ret
Function at 0x484380
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [eax + 8]
mov byte [ebp - 0x15], cl
cmp cl, 3
je 0x484569
push ebx
mov ebx, dword [eax]
xor edx, edx
push edi
movzx edi, byte [eax + 9]
test cl, 2
mov eax, dword [ebp + 0x10]
mov ecx, edi
je 0x4843e3
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edi
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edi
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [edx + 3]
jmp 0x4843f1
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x48440b
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edi, eax
mov dword [ebp + ecx*4 - 0x14], edi
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x484453.3
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x484426
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x48442b
mov edx, 1
inc eax
cmp eax, ecx
jl 0x484415
test dx, dx
je case.0x484453.3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x484453.3
movzx eax, byte [eax + 0x48458c]
jmp dword [eax*4 + 0x484578]
mov ecx, dword [edx + 4]
test ecx, ecx
je case.0x484453.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x484465
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edx + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x484453.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x4844a8
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x484453.3
nop word [eax + eax]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x4844e0
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x484453.3
mov edi, 0x100
nop dword [eax]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x484520
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret
Function at 0x485300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x48531a
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x48531a
push dword [ebp + 0xc]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x48b990
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x48b9c7
push esi
call fcn.0048bb80
add esp, 4
cmp byte [esi + 0x40], 0
je 0x48b9be
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x48b9d2
cmp eax, 0xcb
jne 0x48ba4e
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x48ba38
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x48b9ef
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x48ba32
cmp eax, 2
je 0x48ba38
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48b9e0
cmp eax, 3
je 0x48ba17
cmp eax, 1
jne 0x48b9e0
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x48b9e0
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x48b9e0
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0048ba80
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x48ba70
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0048ba80
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x48ba80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
lea edi, [esi + 0x190]
mov dword [ebp + 8], edi
lea ebx, [esi + 0x78]
je 0x48bab7
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
jmp 0x48baba
mov dword [ebp + 8], edi
mov eax, dword [edi]
cmp byte [eax + 8], 0
je 0x48bb32
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x48bb12
nop dword [eax]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48baee
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x48bb49
cmp eax, dword [esi + 0x60]
jb 0x48bad0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [edi]
cmp byte [eax + 8], 0
jne 0x48bac2
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x496730
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x100
mov edx, dword [esi + 0x4c]
cmp edx, 1
mov ebx, dword [esi + 0x1b8]
sete al
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], edx
mov byte [ebx + 0x1c], al
mov eax, 0x2fe
push dword [esi + 0x64]
mov ecx, dword [esi + 4]
cmovne eax, edi
push eax
push 1
push esi
mov eax, dword [ecx + 8]
call eax
mov dword [ebx + 0x18], eax
xor edi, edi
mov eax, dword [ebx + 0x14]
add esp, 0x10
cmp dword [esi + 0x64], edi
jle 0x496843
mov ecx, dword [ebx + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x4967a1
mov eax, dword [ebx + 0x18]
add dword [eax + edi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov eax, dword [eax + edi*4]
mov dword [ebp - 8], eax
lea eax, [ecx - 1]
push eax
push ebx
push edi
push esi
call fcn.00496ad0
add esp, 0x10
mov edx, eax
xor esi, esi
nop
cmp esi, edx
jle 0x4967dd
mov eax, dword [ebp - 0x10]
inc ebx
dec eax
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.00496ad0
mov edx, eax
add esp, 0x10
cmp esi, edx
jg 0x4967c4
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0xff
jle 0x4967c0
cmp dword [ebp - 4], 1
jne 0x496830
mov ebx, eax
mov ecx, 1
lea edx, [ebx - 1]
nop dword [eax + eax]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x496810
mov esi, dword [ebp + 8]
inc edi
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
cmp edi, dword [esi + 0x64]
jl 0x496784
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ebx, [edi + 0x38]
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ecx, dword [edi + 0x74]
add eax, esi
mov edx, dword [edi + 0x6c]
sub ecx, edx
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ecx
cmp edx, eax
jb 0x4d9d3b
mov ecx, dword [ebx]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004de9c0
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x4d9ce3
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x4d9d10
mov ecx, dword [ebp - 8]
mov edx, dword [edi + 0x6c]
add ecx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x4d9e27
mov eax, dword [ebp + 8]
push ecx
mov eax, dword [eax]
add eax, dword [edi + 0x74]
add eax, edx
push eax
push ebx
call fcn.004da0e0
mov ebx, dword [edi + 0x74]
add esp, 0xc
add ebx, eax
mov dword [ebp - 8], ebx
mov dword [edi + 0x74], ebx
cmp ebx, 3
jb 0x4d9da3
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
movzx edx, byte [eax + ebx]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + ebx + 1]
mov ebx, dword [ebp - 8]
shl edx, cl
xor edx, eax
mov eax, dword [edi + 0x6c]
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 4]
cmp ebx, 0x106
jae 0x4d9dbb
jmp 0x4d9da8
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4d9db8
mov ebx, dword [ebp + 8]
jmp 0x4d9ca2
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x4d9e27
add ebx, eax
cmp ecx, ebx
jae 0x4d9df9
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
lea eax, [edx + ebx]
push esi
push 0
push eax
call fcn.004def40
add esp, 0xc
lea eax, [esi + ebx]
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x4d9e27
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
lea eax, [ecx + edx]
push esi
push 0
push eax
call fcn.004def40
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4da150
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4da15c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004da170