joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49415b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [0x4b31c8]
push edi
xor ebx, ebx
push 1
push ebx
or edi, 0xffffffff
push dword [ebp + 8]
call esi
push ebx
push 0x1e
push dword [ebp + 8]
mov dword [ebp - 8], eax
call esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push 0xa
push eax
push dword [ebp + 8]
call dword [0x4b31d0]
cmp byte [ebp - 0x18], 0x54
jne 0x4941ac
cmp byte [ebp - 0x17], 0x44
je 0x4941b7
cmp byte [ebp - 0x17], 0x64
je 0x4941b7
cmp byte [ebp - 0x17], 0x53
je 0x4941b7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x494185
jmp 0x49420b
mov eax, dword [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ecx], al
call fcn.004945aa
cmp byte [ebp - 0x17], 0x64
pop ecx
jne 0x4941e7
mov dword [0x4aeb52], 1
xor eax, eax
mov cl, byte [ebp - 0xf]
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 7
jl 0x4941d8
jmp 0x4941ed
mov dword [0x4aeb52], ebx
mov edi, dword [ebp - 0x12]
mov eax, dword [ebp - 0x16]
mov ecx, dword [ebp + 0xc]
xor edi, 0x198931
xor eax, 0x19611225
and edi, 0xffffff
mov dword [ecx], eax
add edi, eax
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x49421b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 3], 0
and byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 5], 0x61
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x54
mov byte [ebp - 4], 0x64
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 8], 0x68
mov byte [ebp - 0x11], 0x45
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 6], 0x65
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x4942a4
xor eax, eax
jmp 0x4942b3
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret 8

Function at 0x4942b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
push edi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x14]
push 0xa
push eax
or edi, 0xffffffff
push dword [ebp + 8]
call fcn.00493609
xor eax, eax
mov cl, byte [ebp - 0xb]
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 9
jl 0x4942da
cmp dword [ebp - 0x14], 0x646c6f47
jne 0x49431c
cmp dword [ebp - 0x10], 0x6f736e65
jne 0x49431c
cmp byte [ebp - 0xc], 0x66
jne 0x49431c
mov eax, dword [ebp - 0xb]
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ecx], al
call fcn.004945aa
mov eax, dword [ebp + 0xc]
pop ecx
cmp eax, esi
je 0x494317
mov dword [eax], esi
push 0xa
pop edi
jmp 0x494328
push esi
push esi
push esi
push dword [ebp + 8]
call dword [0x4b31b4]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x49449a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or eax, 0xffffffff
push edi
cmp dword [ebp + 8], eax
mov edi, eax
je 0x49450e
lea eax, [ebp - 0x10]
push 0xa
push eax
push dword [ebp + 8]
call dword [0x4b31d0]
xor eax, eax
mov cl, byte [ebp - 7]
xor byte [ebp + eax - 0x10], cl
inc eax
cmp eax, 9
jl 0x4944bc
cmp dword [ebp - 0x10], 0x646c6f47
jne 0x4944ff
cmp dword [ebp - 0xc], 0x6f736e65
jne 0x4944ff
cmp byte [ebp - 8], 0x66
jne 0x4944ff
mov eax, dword [ebp - 7]
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ecx], al
call fcn.004945aa
mov eax, dword [ebp + 0xc]
pop ecx
test eax, eax
je 0x4944fa
and dword [eax], 0
push 0xa
pop edi
jmp 0x49450c
push 0
push 0
push dword [ebp + 8]
call dword [0x4b31c8]
mov eax, edi
pop edi
leave
ret

Function at 0x494511
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 5], bl
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 9], 0x72
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 3], bl
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x61
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 6], 0x64
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
jne 0x494597
xor eax, eax
jmp 0x4945a6
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret

Function at 0x4945aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4ae908]
push ebx
xor eax, dword [0x4af2be]
push esi
push edi
mov dword [0x4af424], eax
mov dword [0x4aeb46], eax
movzx eax, byte [ebp + 8]
test eax, eax
jle 0x4945d7
mov esi, eax
call fcn.004937e8
dec esi
jne 0x4945cf
xor edi, edi
mov esi, 0x4aeb62
mov dword [ebp + 8], edi
mov ebx, esi
test edi, edi
jne 0x4945ec
call fcn.004937e8
mov al, byte [edi + 0x4aeb46]
xor ecx, ecx
cmp ebx, esi
jle 0x494606
cmp byte [ecx + 0x4aeb62], al
je 0x494606
inc ecx
cmp ecx, dword [ebp + 8]
jl 0x4945f8
cmp ecx, dword [ebp + 8]
jne 0x49460f
mov byte [ebx], al
jmp 0x494613
dec dword [ebp + 8]
dec ebx
inc edi
cmp edi, 4
jne 0x49461b
xor edi, edi
inc dword [ebp + 8]
inc ebx
cmp ebx, 0x4aec62
jl 0x4945e3
call fcn.0049370a
call fcn.004937e8
mov dl, byte [0x4aeb46]
xor esi, esi
movzx edi, dl
mov cl, byte [esi + 0x4aeb62]
lea eax, [esi + 0x4aeb62]
mov bl, cl
xor bl, dl
mov byte [eax], bl
movzx eax, cl
xor eax, edi
inc esi
cmp esi, 0x100
mov byte [eax + 0x4aec62], cl
jl 0x49463c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x494667
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 0xa], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x4946d0
xor eax, eax
jmp 0x4946d9
push esi
call fcn.00492d4b
pop ecx
call esi
pop esi
leave
ret

Function at 0x494787
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 4], 0
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 8], 0x73
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x68
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], 0x74
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 9], 0x70
call fcn.004930aa
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.00492f33
mov esi, eax
add esp, 0x14
test esi, esi
je 0x494835
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00492ffa
push esi
call fcn.00492d4b
add esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x4948bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 5], 0x72
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x73
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 3], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
call fcn.004930aa
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00492f33
mov esi, eax
add esp, 0x14
test esi, esi
je 0x494946
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x494a4e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 3], 0
and byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x4e
call fcn.004930aa
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00492f33
mov esi, eax
add esp, 0x14
test esi, esi
je 0x494ad9
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x494b50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov esi, dword [0x4b31b4]
push edi
xor edi, edi
push 1
push edi
push edi
push dword [ebp + 8]
call esi
push 2
push edi
push edi
mov ebx, eax
push dword [ebp + 8]
call esi
cmp ebx, edi
jne 0x494be7
cmp eax, edi
jne 0x494be7
lea eax, [ebp - 0x14]
push eax
call fcn.004930b0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push eax
mov byte [esi], al
call fcn.004945aa
mov al, byte [esi]
pop ecx
pop ecx
mov dword [ebp - 0x414], 0x646c6f47
mov dword [ebp - 0x410], 0x6f736e65
mov byte [ebp - 0x40c], 0x66
xor ecx, ecx
xor byte [ebp + ecx - 0x414], al
inc ecx
cmp ecx, 9
jl 0x494bb8
mov byte [ebp - 0x40b], al
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x414]
push 0xa
push eax
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call dword [0x4b31a0]
jmp 0x494bef
push edi
push edi
push ebx
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x494d06
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
jle 0x494d7b
imul edx, edx, 0x9e3779b9
test edx, edx
mov dword [ebp + 0x10], edx
je 0x494dd0
mov edx, dword [ebp + 8]
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, eax
sub esi, 0x61c88647
add ebx, ecx
lea ecx, [ebx + edi]
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
shr ebx, 0xb
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, ecx
add ebx, eax
cmp esi, dword [ebp + 0x10]
lea eax, [ebx + edi]
jne 0x494d31
jmp 0x494dcd
imul edx, edx, 0x61c88647
test edx, edx
je 0x494dd0
mov esi, dword [ebp + 8]
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, ecx
add edx, 0x61c88647
add edi, ebx
sub eax, edi
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, eax
add edi, ebx
sub ecx, edi
test edx, edx
jne 0x494d88
mov edi, dword [ebp + 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x495c96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00495d62
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.00495d91
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [0x4b317c]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x495d22
call fcn.00495d62
add esp, 0xc
xor eax, eax
jmp 0x495d5f
call fcn.00495d62
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x495d5c
dec eax
je 0x495d3c
dec eax
je 0x495d4e
jmp 0x495d1e
cmp dword [ebp - 0xa0], ebx
jne 0x495d48
push 4
jmp 0x495d5e
jbe 0x495d4e
push 5
jmp 0x495d5e
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x495d5f
push 3
pop eax
pop ebx
leave
ret
Function at 0x495d91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
mov eax, dword [0x4afa0c]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x495df4
lea eax, [ebp - 0x14]
push eax
call dword [0x4b31e8]
mov dword [0x4afa0c], eax
leave
ret

Function at 0x495df6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x4000000
push 1
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], 0x2e
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x39
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xf], 0x44
call fcn.00495ea2
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x495e67
mov eax, 0xc357
jmp 0x495e9e
push ebx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 8
push eax
push esi
push esi
push 2
push edi
call fcn.00495f2d
push edi
mov ebx, eax
call fcn.00495fcb
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x495e99
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 8]
mov byte [eax], cl
xor eax, eax
jmp 0x495e9e
mov eax, 0xc358
pop edi
pop esi
leave
ret

Function at 0x495ea2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.00495d91
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [0x4b317c]
test eax, eax
jne 0x495efe
leave
ret
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x495f2d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
and byte [ebp - 5], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 6], 0x6c
call fcn.00495d91
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [0x4b317c]
test eax, eax
jne 0x495f99
leave
ret
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x495fcb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.00495d91
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [0x4b317c]
test eax, eax
jne 0x496027
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00495d62
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x496044
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x80
push 3
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x18]
push 0xc0000000
push eax
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x5c
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xf], 0x54
call fcn.00495ea2
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x4960de
push ebx
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 4]
push 4
push eax
push esi
push esi
push 0x80002000
push edi
call fcn.00495f2d
push edi
mov ebx, eax
call fcn.00495fcb
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x4960d7
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [eax], cl
xor eax, eax
jmp 0x4960e3
mov eax, 0xc358
jmp 0x4960e3
mov eax, 0xc357
pop edi
pop esi
leave
ret
Function at 0x4960e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4960fd
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x496110
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x4990dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1c]
cmp ecx, 1
jle 0x4991b7
add eax, 0x32
push esi
dec ecx
movzx edx, byte [eax + 1]
movzx esi, byte [eax - 1]
mov edx, dword [edx*4 + 0x4b2928]
xor edx, dword [esi*4 + 0x4b2128]
movzx esi, byte [eax]
add eax, 0x10
xor edx, dword [esi*4 + 0x4b2528]
movzx esi, byte [eax - 0x12]
xor edx, dword [esi*4 + 0x4b1d28]
mov dword [eax - 0x12], edx
movzx edx, byte [eax - 0xb]
movzx esi, byte [eax - 0xc]
mov edx, dword [edx*4 + 0x4b2928]
xor edx, dword [esi*4 + 0x4b2528]
movzx esi, byte [eax - 0xd]
xor edx, dword [esi*4 + 0x4b2128]
movzx esi, byte [eax - 0xe]
xor edx, dword [esi*4 + 0x4b1d28]
mov dword [eax - 0xe], edx
movzx edx, byte [eax - 7]
movzx esi, byte [eax - 8]
mov edx, dword [edx*4 + 0x4b2928]
xor edx, dword [esi*4 + 0x4b2528]
movzx esi, byte [eax - 9]
xor edx, dword [esi*4 + 0x4b2128]
movzx esi, byte [eax - 0xa]
xor edx, dword [esi*4 + 0x4b1d28]
mov dword [eax - 0xa], edx
movzx edx, byte [eax - 3]
movzx esi, byte [eax - 4]
mov edx, dword [edx*4 + 0x4b2928]
xor edx, dword [esi*4 + 0x4b2528]
movzx esi, byte [eax - 5]
xor edx, dword [esi*4 + 0x4b2128]
movzx esi, byte [eax - 6]
xor edx, dword [esi*4 + 0x4b1d28]
dec ecx
mov dword [eax - 6], edx
jne 0x4990f1
pop esi
ret
Function at 0x499b72
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 0x40
push edi
jle 0x499bbd
lea eax, [ebp - 0xe8]
push eax
call fcn.00499c8f
push ebx
lea eax, [ebp - 0xe8]
push dword [ebp + 8]
push eax
call fcn.00499cb7
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00499d66
add esp, 0x18
lea esi, [ebp - 0x10]
push 0x10
pop ebx
jmp 0x499bc0
mov esi, dword [ebp + 8]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
push 0x10
lea edi, [ebp - 0x50]
pop ecx
xor edx, edx
test ebx, ebx
rep stosd dword es:[edi], eax
jle 0x499bf5
lea eax, [ebp - 0x50]
sub esi, eax
lea eax, [edx + ebp - 0x50]
inc edx
cmp edx, ebx
mov cl, byte [eax + esi]
mov byte [edx + ebp - 0x91], cl
mov byte [eax], cl
jl 0x499be0
xor eax, eax
jmp 0x499bfa
xor byte [eax + ebp - 0x90], 0x36
xor byte [eax + ebp - 0x50], 0x5c
inc eax
cmp eax, 0x40
jl 0x499bf7
lea eax, [ebp - 0xe8]
push eax
call fcn.00499c8f
lea eax, [ebp - 0x90]
push 0x40
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00499cb7
mov esi, dword [ebp + 0x10]
add esp, 0x10
lea eax, [ebp - 0xe8]
mov ecx, esi
push 4
sub eax, esi
pop edi
mov edx, edi
jmp 0x499c46
mov ebx, dword [ecx + eax]
mov dword [ecx], ebx
add ecx, edi
dec edx
jne 0x499c43
lea eax, [ebp - 0xe8]
push eax
call fcn.00499c8f
lea eax, [ebp - 0x50]
push 0x40
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00499cb7
add esp, 0x10
lea eax, [ebp - 0xe8]
lea ecx, [esi + 0x10]
mov edx, edi
jmp 0x499c7f
mov esi, dword [eax]
add eax, edi
mov dword [ecx], esi
add ecx, edi
dec edx
jne 0x499c7c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x499cb7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
mov eax, esi
pop ecx
xor dword [eax], 0x41dfac36
add eax, 4
dec ecx
jne 0x499cc5
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov edx, edi
shr eax, 3
lea ecx, [ecx + edi*8]
and eax, 0x3f
shl edx, 3
cmp ecx, edx
mov dword [esi + 0x10], ecx
jae 0x499cf1
inc dword [esi + 0x14]
push 0x40
mov ecx, edi
pop ebx
shr ecx, 0x1d
add dword [esi + 0x14], ecx
sub ebx, eax
cmp edi, ebx
jb 0x499d44
push ebx
lea eax, [esi + eax + 0x18]
push dword [ebp + 0xc]
push eax
call fcn.0049a83a
lea eax, [esi + 0x18]
push eax
push esi
call fcn.00499dca
add esp, 0x14
mov dword [ebp + 8], ebx
add ebx, 0x3f
cmp ebx, edi
jae 0x499d40
mov eax, dword [ebp + 0xc]
lea eax, [ebx + eax - 0x3f]
push eax
push esi
call fcn.00499dca
add dword [ebp + 8], 0x40
pop ecx
pop ecx
add ebx, 0x40
jmp 0x499d23
xor eax, eax
jmp 0x499d48
and dword [ebp + 8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub edi, ecx
add ecx, edx
push edi
lea eax, [esi + eax + 0x18]
push ecx
push eax
call fcn.0049a83a
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret