joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c55c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c613
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004051ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x47c59e
call fcn.0040473c
jmp 0x47c61a
mov eax, ebx
call fcn.00402f50
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.004051ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x47c5c7
call fcn.0040473c
jmp 0x47c61a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x47c628
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x47c5e8
call fcn.0040473c
jmp 0x47c61a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c61a
mov eax, dword [ebp - 8]
call fcn.00402f6c
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4920ac
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x492135
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x505e84
push 0x202
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x49211f
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040d67c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x49214c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4fffdc]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040dfb8
call fcn.00404690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49213c
lea eax, [ebp - 0x1c]
call fcn.00404d5c
ret

Function at 0x49272c
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x492788]
cmp al, byte [ebx + 0x28]
je 0x492750
mov esi, 0x401
mov eax, ebx
call fcn.00492884
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x492788]
cmp al, byte [ebx + 0x28]
jne 0x492780
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x492814
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0049272c
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403f54
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, eax
mov ecx, 0x49287c
mov eax, ebx
call fcn.00491ff0
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x49286e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403f54
pop esi
pop ebx
ret

Function at 0x4928a0
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004051ec
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403678
test ebx, ebx
je 0x4928ef
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x4929cc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4929fd
mov ecx, dword [0x500158]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040df7c
call fcn.00404690
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x492a2a
mov ecx, dword [0x4ffd9c]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040df7c
call fcn.00404690
xor eax, eax
push ebp
push 0x492aab
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403f54
cmp byte [ebp + 8], 0
je 0x492a85
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00492934
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0049278c
jmp 0x492aa1
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004922e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492ac8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x492ad4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x492b05
mov ecx, dword [0x4ffe54]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040df7c
call fcn.00404690
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x492b32
mov ecx, dword [0x4ffd9c]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040df7c
call fcn.00404690
xor eax, eax
push ebp
push 0x492bae
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403f54
cmp byte [ebp + 8], 0
je 0x492b8a
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00492934
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00492814
jmp 0x492ba4
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004922e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492bcb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x492db4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004925ac
xor eax, eax
push ebp
push 0x492f27
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x492f11
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x492e00
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x492e0a
call fcn.0040473c
jmp 0x492f2e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e534
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x492f06
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x492eb9
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x492ea6
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403f54
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00492d6c
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x492f3c]
cmp dl, byte [eax + 0x28]
je 0x492f0d
call fcn.0040de94
jmp 0x492f0d
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e554
jmp 0x492f0d
cmp edi, ebx
jge 0x492ed5
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e554
jmp 0x492e0a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e534
cmp edx, dword [esp + 4]
jne 0x492ef5
cmp eax, dword [esp]
pop edx
pop eax
jne 0x492e0a
push ebp
call fcn.00492d6c
pop ecx
jmp 0x492f0d
push ebp
call fcn.00492d6c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492f2e
mov eax, dword [ebp - 4]
call fcn.004925b8
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492f40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x493062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004925ac
xor eax, eax
push ebp
push 0x493045
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x492f90
call fcn.0040473c
jmp 0x49304c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49302f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x49302f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403f54
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x49302f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d67c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49307c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4fffdc]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040dfb8
call fcn.00404690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49304c
mov eax, dword [ebp - 4]
call fcn.004925b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493069
lea eax, [ebp - 0x28]
call fcn.00404d5c
ret
Function at 0x4930c8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x493212
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004925ac
xor eax, eax
push ebp
push 0x4931f5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x49312d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x49312d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4931df
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x493140
call fcn.0040473c
jmp 0x4931fc
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4931df
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4931df
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403f54
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4931df
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d67c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49322c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4fffdc]
mov dl, 1
mov eax, dword [0x491098]
call fcn.0040dfb8
call fcn.00404690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4931fc
mov eax, dword [ebp - 4]
call fcn.004925b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493219
lea eax, [ebp - 0x28]
call fcn.00404d5c
ret
Function at 0x4949dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, eax
test esi, esi
jne 0x4949f2
mov eax, esi
call fcn.004949b0
mov edi, 1
jmp 0x4949fa
inc edi
cmp byte [esi + edi - 1], 0x20
je 0x4949f9
cmp byte [esi + edi - 1], 0x2d
jne 0x494a0f
mov eax, esi
call fcn.004949b0
cmp byte [esi + edi - 1], 0x2b
jne 0x494a17
inc edi
cmp byte [esi + edi - 1], 0x24
je 0x494a3a
cmp byte [esi + edi - 1], 0x30
jne 0x494af4
movzx eax, byte [esi + edi]
call fcn.004033e0
cmp al, 0x58
jne 0x494af4
cmp byte [esi + edi - 1], 0x30
jne 0x494a42
inc edi
inc edi
cmp byte [esi + edi - 1], 0
jne 0x494a51
mov eax, esi
call fcn.004949b0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x494ae5
mov eax, ebx
add al, 0xd0
sub al, 0xa
jb 0x494a7c
add al, 0xf9
sub al, 6
jb 0x494a87
add al, 0xe6
sub al, 6
jb 0x494a92
jmp 0x494a9d
movzx eax, bl
sub eax, 0x30
mov dword [ebp - 0x1c], eax
jmp 0x494aa4
movzx eax, bl
sub eax, 0x37
mov dword [ebp - 0x1c], eax
jmp 0x494aa4
movzx eax, bl
sub eax, 0x57
mov dword [ebp - 0x1c], eax
jmp 0x494aa4
mov eax, esi
call fcn.004949b0
mov eax, dword [ebp - 0x14]
shr eax, 0x1c
xor edx, edx
cmp edx, 0
jne 0x494ab8
cmp eax, 0
jbe 0x494ac1
jmp 0x494aba
jle 0x494ac1
mov eax, esi
call fcn.004949b0
mov eax, dword [ebp - 0x1c]
cdq
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 4
shl eax, 4
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc edi
movzx ebx, byte [esi + edi - 1]
test bl, bl
jne 0x494a66
jmp 0x494b6c
cmp byte [esi + edi - 1], 0
jne 0x494b02
mov eax, esi
call fcn.004949b0
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x494b57
xor bl, 0x30
movzx eax, bl
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 0xa
mul ecx
or edx, edx
jne 0x494b3f
mov esi, eax
mov eax, dword [ebp - 8]
mul ecx
add edx, esi
add eax, dword [ebp - 0xc]
adc edx, 0
jb 0x494b3f
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
jmp 0x494b46
mov dword [ebp - 0xc], 0x29a
pop esi
mov eax, dword [ebp - 0xc]
sub eax, 0xa
jb 0x494b56
mov eax, esi
call fcn.004949b0
inc edi
movzx ebx, byte [esi + edi - 1]
test bl, bl
jne 0x494b0e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495788
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00403140
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x4958e4
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x4957da
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00403140
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x49591c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, str.80_
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x495951
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x495958
add edi, 7
sar edi, 3
mov ebx, dword [esp]
movzx ebx, byte [ebx + edi]
and bl, byte [edx + 0x4fb288]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x49593f
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x4fb278
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x4959a6
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x4959b4
movzx edx, byte [esp + edi]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x49598b
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.00403678
xor ecx, ecx
mov ebp, 0x4fb248
movzx eax, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x495a01
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
movzx eax, byte [edx + 0x4fb288]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x4959d2
cmp byte [esp + 8], 0
je 0x495a64
movzx eax, byte [esp + 9]
shl eax, 0x18
movzx edx, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xd]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
movzx eax, byte [esp + 0xa]
shl eax, 0x18
movzx edx, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xe]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x495acf
movzx edx, byte [esp + 9]
shl edx, 0x18
movzx ecx, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
movzx edx, byte [esp + 0xa]
shl edx, 0x18
movzx ecx, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x495985
mov eax, dword [esp + 4]
movzx edx, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.004956d0
mov edx, eax
mov eax, 4
call fcn.004956d8
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x495b81
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x495b4f
cmp byte [ebp + 8], 0
jne 0x495cb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x495c85
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x495c5f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x495cb0
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x495c9d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4