joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b2c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x46b2e5
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x46b42b
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x46b311
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x46b42b
test eax, eax
jbe 0x46b3b2
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x46b342
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, edi
call fcn.00402c84
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x46b3b2
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.00402c84
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x88]
mov eax, dword [eax]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x8c]
mov eax, dword [eax]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0046af54
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x46b408
mov eax, dword [esi]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0046af54
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x46b3b7
test edi, edi
jbe 0x46b421
lea edx, [ebx + 0x88]
mov eax, esi
mov ecx, edi
call fcn.00402c84
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46b434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x46b459
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x46b5a2
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x46b485
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x46b5a2
test eax, eax
jbe 0x46b527
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x46b4b7
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x46b527
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c84
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x88]
call fcn.0046b0dc
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x46b57e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046b0dc
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x46b52c
test edi, edi
jbe 0x46b598
lea edx, [ebx + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46bbbc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dl, byte [eax + 1]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x46bc35
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
mov esi, edx
and esi, 0xff
mov cl, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov bl, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
and ecx, 0xff
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x46bbe5
mov cl, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46bc48
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dl, byte [eax + 1]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x46bcc1
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
mov esi, edx
and esi, 0xff
mov cl, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov bl, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
and ecx, 0xff
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x46bc71
mov cl, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46bd60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0x10
mov esi, dword [esp]
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.0046bd0c
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
add esi, 4
dec bp
jne 0x46bd73
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x40]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x44]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46bdb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0xfff0
mov esi, dword [esp]
add esi, 0x44
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.0046bd0c
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
sub esi, 4
inc bp
jne 0x46bdca
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 4]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46be08
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, 4
mov ecx, 0x4f4090
mov eax, dword [esp]
add eax, 0x48
mov dword [esp + 0x10], eax
mov ebx, pe_nt_image_headers32
mov eax, ecx
mov edx, dword [esp + 0x10]
mov esi, dword [eax]
mov dword [edx], esi
add edx, 4
add eax, 4
dec ebx
jne 0x46be35
add dword [esp + 0x10], 0x400
add ecx, 0x400
dec edi
jne 0x46be2a
xor ebx, ebx
mov edi, 0x12
mov dword [esp + 0x14], 0x4f4048
mov eax, dword [esp]
mov dword [esp + 0x18], eax
xor ebp, ebp
mov esi, 4
shl ebp, 8
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx]
or ebp, eax
inc ebx
mov eax, dword [esp + 4]
call fcn.004054f0
cmp ebx, eax
jl 0x46be8d
xor ebx, ebx
dec esi
jne 0x46be70
mov eax, dword [esp + 0x14]
xor ebp, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [eax], ebp
add dword [esp + 0x18], 4
add dword [esp + 0x14], 4
dec edi
jne 0x46be69
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.0046bd60
mov eax, dword [esp]
mov edx, dword [esp + 8]
mov dword [eax + edi*4], edx
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, 0x12
jl 0x46beb7
mov edi, 4
mov esi, dword [esp]
xor ebx, ebx
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.0046bd60
mov eax, dword [esp + 8]
mov dword [esi + ebx*4 + 0x48], eax
mov eax, dword [esp + 0xc]
mov dword [esi + ebx*4 + 0x4c], eax
add ebx, 2
cmp ebx, 0x100
jl 0x46beee
add esi, 0x400
dec edi
jne 0x46beec
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46c068
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x4f5090
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x46c0ed
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x46c142
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
xor cl, byte [esi]
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
and ebx, 0xff
mov bl, byte [edi + ebx]
mov byte [esp + 4], bl
xor ebx, ebx
mov bl, al
mov bl, byte [ebx + 0x4f53b0]
xor bl, cl
mov esi, edx
and esi, 0xff
xor bl, byte [esi + 0x4f52b0]
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x4f52b0]
mov byte [esp + 5], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [ebx + 0x4f52b0]
mov esi, eax
and esi, 0xff
xor bl, byte [esi + 0x4f53b0]
mov esi, edx
and esi, 0xff
xor bl, byte [esi + 0x4f53b0]
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [ebx + 0x4f53b0]
mov esi, eax
and esi, 0xff
xor bl, byte [esi + 0x4f52b0]
xor bl, dl
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x4f53b0]
mov byte [esp + 7], bl
and ecx, 0xff
xor al, byte [ecx + 0x4f53b0]
and edx, 0xff
xor al, byte [edx + 0x4f53b0]
xor edx, edx
mov dl, byte [esp + 4]
xor al, byte [edx + 0x4f52b0]
xor edx, edx
mov dl, byte [esp + 5]
xor ecx, ecx
mov cl, byte [esp + 6]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 7]
shl ecx, 0x10
or edx, ecx
and eax, 0xff
shl eax, 0x18
or edx, eax
mov eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46c2d0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x4f5090
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x46c355
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x46c3aa
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
xor cl, byte [esi]
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
and ebx, 0xff
mov bl, byte [edi + ebx]
mov byte [esp + 4], bl
and ecx, 0xff
and eax, 0xff
shl eax, 8
or ecx, eax
xor eax, eax
mov al, dl
shl eax, 0x10
or ecx, eax
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
or ecx, eax
mov eax, ecx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46d58c
Capabilities:
Encrypt data using camellia

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, ecx
mov esi, dword [eax]
xor esi, dword [edx]
mov eax, dword [eax + 4]
xor eax, dword [edx + 4]
mov edx, eax
shr edx, 0x18
and edx, 0xff
mov dl, byte [edx + 0x4f54b0]
mov byte [esp], dl
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x4f55b0]
mov byte [esp + 1], dl
mov edx, eax
shr edx, 8
and edx, 0xff
mov dl, byte [edx + 0x4f56b0]
mov byte [esp + 2], dl
and eax, 0xff
mov al, byte [eax + 0x4f57b0]
mov byte [esp + 3], al
mov eax, esi
shr eax, 0x18
and eax, 0xff
mov al, byte [eax + 0x4f55b0]
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x4f56b0]
mov ecx, esi
shr ecx, 8
and ecx, 0xff
mov cl, byte [ecx + 0x4f57b0]
mov ebx, esi
and ebx, 0xff
mov bl, byte [ebx + 0x4f54b0]
mov byte [esp + 4], bl
mov bl, byte [esp]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 5], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 3]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 7], bl
mov bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, cl
mov byte [esp + 8], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 9], bl
mov bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 0xa], bl
mov bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 0xb], bl
mov bl, byte [esp]
xor bl, byte [esp + 3]
xor al, bl
xor dl, al
xor cl, dl
mov eax, ecx
and eax, 0xff
xor edx, edx
mov dl, byte [esp + 0xb]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xa]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 9]
shl edx, 0x18
or eax, edx
mov dword [edi], eax
xor eax, eax
mov al, byte [esp + 8]
xor edx, edx
mov dl, byte [esp + 7]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 6]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 5]
shl edx, 0x18
or eax, edx
mov dword [edi + 4], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x473e4c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov dword [esp], edx
mov esi, eax
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.00402f74
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.00402f74
lea eax, [esp + 0x94]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x38
mov dword [esp + 0xc], eax
xor ecx, ecx
mov eax, 0x4f78e0
xor ebx, ebx
mov bl, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x4f7948]
jbe 0x473eca
mov edx, dword [esp + 4]
mov byte [edx + ecx], 1
jmp 0x473ed2
mov edx, dword [esp + 4]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x473ea6
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, 0x4f7968
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00402f74
xor ecx, ecx
cmp ecx, 0x1c
jae 0x473f02
mov eax, 0x1c
jmp 0x473f07
mov eax, 0x38
xor ebx, ebx
mov bl, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x473f15
mov eax, ebx
jmp 0x473f1a
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp + 4]
mov al, byte [edx + eax]
mov edx, dword [esp + 8]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x473ef6
xor ecx, ecx
mov esi, 0x4f7918
xor eax, eax
mov al, byte [esi]
mov edx, dword [esp + 8]
cmp byte [edx + eax - 1], 0
jbe 0x473f71
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x4f7948]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x473f35
mov edx, dword [esp + 0xc]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0x10]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 0xc]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0x10]
inc edi
cmp dword [esp + 0x10], 0x10
jne 0x473ee4
mov edx, dword [esp]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.00402c84
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x474010
Capabilities:
Encrypt data using des
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov dword [esp], edx
mov esi, eax
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.00402f74
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.00402f74
lea eax, [esp + 0x94]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x38
mov dword [esp + 0xc], eax
xor ecx, ecx
mov eax, 0x4f78e0
xor ebx, ebx
mov bl, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x4f7948]
jbe 0x47408e
mov edx, dword [esp + 4]
mov byte [edx + ecx], 1
jmp 0x474096
mov edx, dword [esp + 4]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x47406a
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, 0x4f7968
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00402f74
xor ecx, ecx
cmp ecx, 0x1c
jae 0x4740c6
mov eax, 0x1c
jmp 0x4740cb
mov eax, 0x38
xor ebx, ebx
mov bl, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x4740d9
mov eax, ebx
jmp 0x4740de
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp + 4]
mov al, byte [edx + eax]
mov edx, dword [esp + 8]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x4740ba
xor ecx, ecx
mov esi, 0x4f7918
xor eax, eax
mov al, byte [esi]
mov edx, dword [esp + 8]
cmp byte [edx + eax - 1], 0
jbe 0x474135
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x4f7948]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x4740f9
mov edx, dword [esp + 0xc]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0x10]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 0xc]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0x10]
inc edi
cmp dword [esp + 0x10], 0x10
jne 0x4740a8
xor ecx, ecx
mov eax, ecx
add eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x14]
mov edx, 0x1e
sub edx, dword [esp + 0x10]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + esi*4 + 0x14], ebx
mov dword [esp + edx*4 + 0x14], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x18]
mov edx, 0x1f
sub edx, dword [esp + 0x10]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + esi*4 + 0x18], ebx
mov dword [esp + edx*4 + 0x14], eax
inc ecx
cmp ecx, 8
jne 0x4741b9
mov edx, dword [esp]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.00402c84
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret