joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44be56
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x44be75
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x44be64
pop edi
cmp esi, 4
jb 0x44be7f
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x44be90
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x44be9c
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x44bea6
movzx ecx, byte [ecx]
xor eax, ecx
ret

Function at 0x4577a1
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x4938df
call fcn.0048cc90
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.0040254c
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.00457824
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45feeb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
mov al, byte [edi + 2]
mov word [esi], bx
cmp byte [edi + 1], bl
mov byte [ebp + 0xf], al
je 0x45ff7d
lea eax, [edi + 0x20]
lea ecx, [esi + 0x24]
push eax
call fcn.004025ce
lea eax, [edi + 0x2c]
lea ecx, [esi + 0x60]
push eax
call fcn.00424a02
cmp byte [edi + 4], bl
je 0x45ff39
or byte [esi + 1], 8
jmp 0x45ff3e
and word [esi], 0xf7ff
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x84], eax
mov al, byte [edi + 3]
mov byte [esi + 0x88], al
cmp byte [ebp + 0xf], bl
mov byte [esi + 0x41], bl
mov byte [esi + 0x40], 0x3f
mov byte [esi + 5], bl
mov word [esi + 0x42], bx
jne 0x45ff9d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x58], bl
je 0x45ff9d
or byte [esi], 1
jmp 0x45ffa2
and word [esi], 0xfffe
cmp byte [ebp + 8], bl
je 0x45ffac
or byte [esi], 8
jmp 0x45ffb1
and word [esi], 0xfff7
cmp byte [ebp + 0xf], bl
je 0x45ffcd
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov byte [esi + 4], 0x14
mov word [esi + 2], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.0041cfd2
mov byte [edi + 0xe], bl
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.0041cfd2
cmp byte [ebp + 0xf], bl
mov byte [edi + 0xe], bl
je 0x460005
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov byte [esi + 4], 0x14
mov word [esi + 2], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
jmp 0x460031
mov eax, dword [ebp - 4]
cmp byte [eax + 0x58], bl
je 0x460031
cmp byte [eax + 0x48], bl
je 0x460031
cmp dword [eax + 0x50], ebx
jne 0x46001c
push 8
pop ecx
jmp 0x460022
mov ecx, dword [eax + 0x4c]
movzx ecx, byte [ecx]
mov dl, byte [eax + 0x49]
movzx cx, cl
push ecx
mov ecx, esi
call fcn.00460038
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x460038
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x493e70
call fcn.0048cc90
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.004600a9
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x30]
push eax
call fcn.0045cb07
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x50]
push eax
call fcn.0045cb07
push dword [ebp - 0x1c]
call fcn.00401c9a
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x464220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00463fc0
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x464299
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x464299
ja 0x464293
cmp edi, eax
jb 0x464299
cmp eax, ebx
mov edi, eax
je 0x4642db
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.00464010
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x4642cd
mov ecx, esi
call fcn.004641e0
cmp eax, ebx
jne 0x4642fe
cmp dword [esp + 0x18], ebx
jg 0x464261
cmp dword [esp + 0x20], ebx
je 0x4642ef
jmp 0x464261
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x464229
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00463fc0
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x464299
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x464299
ja 0x464293
cmp edi, eax
jb 0x464299
cmp eax, ebx
mov edi, eax
je 0x4642db
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.00464010
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x4642cd
mov ecx, esi
call fcn.004641e0
cmp eax, ebx
jne 0x4642fe
cmp dword [esp + 0x18], ebx
jg 0x464261
cmp dword [esp + 0x20], ebx
je 0x4642ef
jmp 0x464261
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x466a80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.00466130
push 0x41
mov ecx, esi
call fcn.00466130
push 0x59
mov ecx, esi
call fcn.00466130
push 0x26
mov ecx, esi
call fcn.00466130
push 0x53
mov ecx, esi
call fcn.00466130
push 0x59
mov ecx, esi
call fcn.00466130
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x466b10
test cl, cl
jbe 0x466b0c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x4aa9f4]
xor eax, edi
dec ecx
jne 0x466af6
xor edi, edi
jmp 0x466b3f
cmp bl, cl
jne 0x466b17
inc edi
jmp 0x466b22
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x4aa9f4]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x466ace
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.00466170
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.00466290
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x466d50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00466b80
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a0], bl
je 0x466dcc
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x17c]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.004881d0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x466e09
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x178
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x466dde
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00466ee0
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a0], bl
je 0x466ec9
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x19c]
inc ebp
cmp ebp, eax
jne 0x466e54
xor ebp, ebp
cmp dword [edi + 0x1b4], ebx
je 0x466ea5
lea ecx, [edi + 0x148]
call fcn.0040c8b6
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b4]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x17c]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.00488220
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x46dc60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x494647
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x49c4a0
mov dword [esi + 4], 0x49c490
mov dword [esi + 8], 0x49c480
mov dword [esi + 0xc], 0x49c470
mov dword [esi + 0x10], 0x49c45c
mov dword [esi + 0x14], 0x49c448
mov dword [esi + 0x18], 0x49c438
mov dword [esi + 0x1c], 0x49c428
mov edx, 0x49c7e4
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0047e540
mov ecx, dword [esi + 0x24]
call fcn.00476850
mov esi, dword [esi + 0xcc]
test esi, esi
je 0x46dce3
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x472450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x494783
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0040ae33
xor esi, esi
mov dword [esp + 0xac], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x94], esi
push 0x40000
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb0], 1
call fcn.0040ae52
test al, al
je 0x4724c5
push 0x40000
lea ecx, [esp + 0x78]
call fcn.0040c853
test al, al
jne 0x4724e1
lea ecx, [esp + 0x74]
call fcn.0040c88f
lea ecx, [esp + 0x28]
call fcn.0040ae90
mov eax, 0x8007000e
jmp 0x472a1d
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x28]
mov dword [esp + 0x34], eax
call fcn.0040aea1
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x20], 0x20
mov dword [esp + 0x88], ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x24], esi
call fcn.0040c89e
mov ebx, dword [esp + 0xc0]
lea edi, [ebp + 0x20]
mov ecx, 0x1000
mov eax, 0x1000100
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x1c], 9
mov dword [esp + 0x14], 0x101
mov dword [esp + 0x68], 0xffffffff
mov byte [esp + 0x13], 0
mov byte [esp + 0x11], 0
mov dword [esp + 0x18], 1
Function at 0x475030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x47506e
mov ecx, ebx
call fcn.00486ac0
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.00487150
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.00487260
jmp 0x47508a
test esi, esi
jbe 0x47508a
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x47508c
mov ecx, ebx
call fcn.00486ac0
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.00487150
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x4750b3
lea esi, [ebx + 0x60]
mov ecx, esi
call fcn.00486ac0
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00487150
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x475150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xc8]
cmp edi, 0x40
jbe 0x4751cb
lea ecx, [esp + 0x60]
call fcn.00486ac0
mov edx, dword [esp + 0xc4]
push edi
lea ecx, [esp + 0x64]
call fcn.00487150
lea edx, [esp + 0xc]
lea ecx, [esp + 0x60]
call fcn.00487260
xor eax, eax
xor ecx, ecx
xor edx, edx
mov ch, byte [esp + eax + 0xc]
mov dl, byte [esp + eax + 0xe]
mov cl, byte [esp + eax + 0xd]
add eax, 4
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esp + eax + 0xb]
shl ecx, 8
or ecx, edx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], ecx
jb 0x47519d
jmp 0x475204
xor eax, eax
test edi, edi
jbe 0x475204
push ebp
mov ebp, dword [esp + 0xc8]
mov ecx, eax
mov edx, eax
shr ecx, 2
and edx, 3
lea esi, [esp + ecx*4 + 0x24]
mov ecx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x4751d9
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x47520d
mov ecx, ebx
call fcn.00486ac0
push 0x10
lea edx, [esp + 0x24]
mov ecx, ebx
call fcn.00487370
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x47523b
lea esi, [ebx + 0x60]
mov ecx, esi
call fcn.00486ac0
push 0x10
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.00487370
pop edi
pop esi
pop ebx
add esp, 0xb4
ret 8
Function at 0x4752c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 5
call fcn.00487320
lea ecx, [ebp + 0x60]
push 5
lea edx, [esp + 0x54]
call fcn.00487320
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, 5
mov esi, ebx
lea edi, [esp + 0x10]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x475342
mov esi, eax
lea eax, [esp + 0x50]
lea edx, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.00486af0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x50]
push ecx
lea ecx, [ebp + 0x60]
call fcn.00486af0
lea ecx, [esp + 0x10]
mov eax, ebx
sub ecx, ebx
mov edx, 5
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x475334
dec esi
jne 0x475306
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8

Function at 0x476190
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x4761c1
lea ecx, [esp + 0x4c]
call fcn.00486ac0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.00487150
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xb0]
call fcn.00487260
pop edi
pop esi
pop ebx
add esp, 0xa0
ret 4
Function at 0x477390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
push edi
mov ebp, ecx
xor edi, edi
and esi, 7
mov dword [esp + 0xc], ebp
cmp edx, 5
jae 0x4773b7
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx - 4]
add ebx, ebp
mov dword [esp + 0x14], ebx
lea edx, [edi + ebp]
cmp edx, ebx
jae 0x4773df
lea ecx, [ecx]
mov cl, byte [edx]
and cl, 0xfe
cmp cl, 0xe8
je 0x4773df
inc edx
cmp edx, ebx
jb 0x4773d0
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, ebp
sub edi, ebp
cmp edx, ebx
jae 0x4774cb
cmp ecx, 2
jbe 0x477437
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x4774bc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [esp + 0x1c]
lea ebp, [edi + ecx]
add edi, 5
cmp dword [esp + 0x24], 0
je 0x477460
add eax, ebp
jmp 0x477462
shr esi, cl
test esi, esi
je 0x4773f8
cmp esi, 4
ja 0x477455
cmp esi, 3
je 0x477455
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x4773f8
or esi, 8
shr esi, 1
inc edi
jmp 0x4773c6
sub eax, ebp
test esi, esi
je 0x477496
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x477490
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [esp + 0x24], 0
je 0x47748e
add eax, ebp
jmp 0x477490
sub eax, ebp
mov ebx, dword [esp + 0x14]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x4773c6
mov ebp, dword [esp + 0x10]
or esi, 8
shr esi, 1
inc edi
jmp 0x4773c6
pop ebx
cmp ecx, 2
jbe 0x4774e4
mov edx, dword [esp + 0x1c]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc
mov edx, dword [esp + 0x1c]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc

Function at 0x478740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
or eax, 0xffffffff
push esi
mov dword [ecx + 0x34], edx
mov byte [ecx + 0x1f], dl
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x468], eax
mov dword [ecx + 0x46c], eax
mov dword [ecx + 0x30], 0x20
mov dword [ecx + 0x48], 4
mov word [ecx + 0x1d], 1
lea esi, [ecx + 0x60]
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x478772
pop esi
ret
Function at 0x47f310
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x47f320
pop edi
pop ebx
ret

Function at 0x47f350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x47f360
pop esi
pop ebp
pop ebx
ret 4

Function at 0x47f600
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x47f771
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x47f68a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x47f660
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x47f644
cmp edx, 0x10
jae 0x47f70b
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x47f6b0
cmp edx, dword [esp + 0x1c]
jae 0x47f771
or eax, 8
xor edi, edi
cmp eax, 1
je 0x47f6f1
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x47f6c4
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x47f6b0
cmp edx, dword [esp + 0x1c]
jae 0x47f771
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x47f720
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x47f756
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x47f730
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x47f720
pop edi
pop ebp
add esp, 0xc
ret 0xc