joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x598994
call fcn.0051a22c
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
add ecx, 8
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 4
mov eax, dword [ebp - 0x2c]
add eax, 4
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 8
mov eax, dword [ebp - 0x2c]
add eax, 8
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0xc
mov eax, dword [ebp - 0x2c]
add eax, 0xc
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0x10
mov eax, dword [ebp - 0x2c]
add eax, 0x10
call fcn.0051a3e0
inc dword [ebp - 8]
mov edx, dword [ebp - 0x28]
add edx, 0x14
mov eax, dword [ebp - 0x2c]
add eax, 0x14
call fcn.0051a3e0
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x18]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0x28]
add edx, 0x1c
mov eax, dword [ebp - 0x2c]
add eax, 0x1c
call fcn.0051a3e0
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x24]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x28]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x28], al
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x29]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x29], al
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0x2a]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x2a], al
mov edx, dword [ebp - 0x28]
add edx, 0x30
mov eax, dword [ebp - 0x2c]
add eax, 0x30
call fcn.00427920
mov edx, dword [ebp - 0x28]
add edx, 0x38
mov eax, dword [ebp - 0x2c]
add eax, 0x38
call fcn.00427920
mov edx, dword [ebp - 0x28]
add edx, 0x40
mov eax, dword [ebp - 0x2c]
add eax, 0x40
call fcn.0051a3e0
inc dword [ebp - 8]
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x45f69c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x45f6b7
xor eax, eax
jmp 0x45f6ff
mov edx, dword [esp + 0x10]
sub edx, 1
jb 0x45f6c7
je 0x45f6ce
dec edx
je 0x45f6e8
jmp 0x45f6fd
mov eax, 3
jmp 0x45f6ff
mov eax, dword [esp + 8]
test eax, eax
jne 0x45f6dd
mov eax, 4
jmp 0x45f6ff
test eax, eax
jbe 0x45f6e8
mov eax, 5
jmp 0x45f6ff
cmp dword [esp + 4], 5
jae 0x45f6f6
mov eax, 6
jmp 0x45f6ff
mov eax, 7
jmp 0x45f6ff
xor eax, eax
add esp, 0x94
ret

Function at 0x4648cc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x4648e7
xor eax, eax
jmp 0x46492f
mov edx, dword [esp + 0x10]
sub edx, 1
jb 0x4648f7
je 0x4648fe
dec edx
je 0x464918
jmp 0x46492d
mov eax, 3
jmp 0x46492f
mov eax, dword [esp + 8]
test eax, eax
jne 0x46490d
mov eax, 4
jmp 0x46492f
test eax, eax
jbe 0x464918
mov eax, 5
jmp 0x46492f
cmp dword [esp + 4], 5
jae 0x464926
mov eax, 6
jmp 0x46492f
mov eax, 7
jmp 0x46492f
xor eax, eax
add esp, 0x94
ret

Function at 0x46693c
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4669f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [sym.SDCWServiceApp.exe__Dogtestqytopro_DogAddr], 0x5a
mov dword [sym.SDCWServiceApp.exe__Dogtestqytopro_DogBytes], 7
lea eax, [ebp - 0x13]
mov dword [sym.SDCWServiceApp.exe__Dogtestqytopro_DogData], eax
call fcn.00466326
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
add eax, 0x5a
push eax
mov eax, 0xff
pop edx
mov ecx, edx
cdq
idiv ecx
push edx
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp + eax - 0x14]
xor dl, 0xff
and edx, 0xff
pop eax
sub edx, eax
xor edx, 0xff
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrCat_qqrv
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x466983
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4669fb
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x469bd0
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x469beb
xor eax, eax
jmp 0x469c33
mov edx, dword [esp + 0x10]
sub edx, 1
jb 0x469bfb
je 0x469c02
dec edx
je 0x469c1c
jmp 0x469c31
mov eax, 3
jmp 0x469c33
mov eax, dword [esp + 8]
test eax, eax
jne 0x469c11
mov eax, 4
jmp 0x469c33
test eax, eax
jbe 0x469c1c
mov eax, 5
jmp 0x469c33
cmp dword [esp + 4], 5
jae 0x469c2a
mov eax, 6
jmp 0x469c33
mov eax, 7
jmp 0x469c33
xor eax, eax
add esp, 0x94
ret
Function at 0x46bc40
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46bcf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [sym.SDCWServiceApp.exe__Dogtesttemp_DogAddr], 0x5a
mov dword [sym.SDCWServiceApp.exe__Dogtesttemp_DogBytes], 7
lea eax, [ebp - 0x13]
mov dword [sym.SDCWServiceApp.exe__Dogtesttemp_DogData], eax
call fcn.0046b62a
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
add eax, 0x5a
push eax
mov eax, 0xff
pop edx
mov ecx, edx
cdq
idiv ecx
push edx
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp + eax - 0x14]
xor dl, 0xff
and edx, 0xff
pop eax
sub edx, eax
xor edx, 0xff
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrCat_qqrv
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x46bc87
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bcff
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x46cedc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x5acfb0
call fcn.0051a22c
mov word [ebp - 0x1c], 0x14
mov edx, 0x5ac425
lea eax, [ebp - 4]
call fcn.0051a3a8
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 8
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call sub.cc3260mt.dll___bnwa_qui
pop ecx
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x30]
push edx
push dword [ebp - 0x34]
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46cf5a
mov word [ebp - 0x1c], 0x20
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x34]
call fcn.0051a3a8
inc dword [ebp - 0x10]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0051a5fc
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0051a5cc
mov word [ebp - 0x1c], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0051a5fc
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x38
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0051a5cc
pop eax
mov word [ebp - 0x1c], 0x2c
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x472b68
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, 0x5af43c
call fcn.0051a22c
mov dword [ebp - 8], 3
lea edx, [ebp + 0x14]
lea eax, [ebp + 0x14]
call fcn.0051a3e0
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.0051a3e0
inc dword [ebp - 8]
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.0051a3e0
inc dword [ebp - 8]
mov byte [ebp - 0x25], 0
push 0xf003f
lea eax, [ebp + 0x14]
call fcn.004050d4
push eax
lea eax, [ebp + 0x10]
call fcn.004050d4
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x472c41
push 0xf01ff
lea eax, [ebp + 0xc]
call fcn.004050d4
push eax
push dword [ebp - 0x30]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x472c39
mov dword [ebp - 0x34], 5
jmp 0x472c16
cmp dword [ebp - 0x4c], 4
jne 0x472c0c
mov byte [ebp - 0x25], 1
jmp 0x472c31
push 0x1388
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 0x34]
add dword [ebp - 0x34], 0xffffffff
test edx, edx
jle 0x472c31
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x2c]
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x472c00
push dword [ebp - 0x2c]
call sub.advapi32.dll_CloseServiceHandle
push dword [ebp - 0x30]
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [ebp - 0x25]
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.0051a5cc
dec dword [ebp - 8]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.0051a5cc
dec dword [ebp - 8]
lea eax, [ebp + 0x14]
mov edx, 2
call fcn.0051a5cc
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47e194
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
mov ecx, 0x5b1184
push ebx
push esi
push edi
lea esi, [ebp - 0xcc]
xor edx, edx
mov dl, byte [ecx]
mov ebx, edx
and ebx, 7
mov dword [ebp - 8], ebx
sar edx, 3
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx + edx]
mov ebx, dword [ebp - 8]
and dx, word [ebx*2 + 0x5b1114]
je 0x47e1d4
mov dl, 1
jmp 0x47e1d6
xor edx, edx
mov byte [esi], dl
inc eax
inc esi
inc ecx
cmp eax, 0x38
jl 0x47e1ad
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x5b11bc
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp + edx*4 - 0x94], ecx
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x94], ecx
xor eax, eax
lea ecx, [ebp - 0x104]
mov edx, dword [ebp - 0x10]
mov esi, edx
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x1c
jge 0x47e234
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x47e23d
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x47e21e
mov edx, dword [ebp - 0x10]
mov eax, 0x1c
mov esi, edx
lea ecx, [ebp - 0xe8]
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x38
jge 0x47e26a
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x47e273
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x38
jl 0x47e254
mov ecx, dword [ebp - 0xc]
xor eax, eax
lea edx, [ebp + ecx*4 - 0x94]
mov dword [ebp - 0x14], edx
mov edx, 0x5b11cc
mov ecx, dword [ebp - 8]
lea ebx, [ebp + ecx*4 - 0x94]
mov ecx, 0x5b1124
movzx esi, byte [edx]
cmp byte [ebp + esi - 0x104], 0
je 0x47e2ae
mov esi, dword [ecx]
or dword [ebx], esi
movzx esi, byte [edx + 0x18]
cmp byte [ebp + esi - 0x104], 0
je 0x47e2c3
mov esi, dword [ecx]
mov edi, dword [ebp - 0x14]
or dword [edi], esi
inc eax
add ecx, 4
inc edx
cmp eax, 0x18
jl 0x47e29d
inc dword [ebp - 4]
inc dword [ebp - 0x10]
cmp dword [ebp - 4], 0x10
jl 0x47e1ec
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x94]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047e338
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x38
push 0
push eax
call fcn.0048338c
add esp, 0xc
lea edx, [ebp - 0x104]
push 0x38
push 0
push edx
call fcn.0048338c
add esp, 0xc
lea ecx, [ebp - 0x94]
push pe_nt_image_headers32
push 0
push ecx
call fcn.0048338c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e860
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x5c
push 0
push ebx
call sub.cc3260mt.dll__memset
add esp, 0xc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret
Function at 0x47f264
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5b1b0c
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.0047e860
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.0047e860
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
cmp si, 0x40
jbe 0x47f2d1
push esi
push edi
push ebx
call fcn.0047eb0c
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.0047ebbc
add esp, 8
push ebx
call fcn.0047e860
pop ecx
jmp 0x47f2e2
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x47f2e7
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.0047eb0c
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x47f304
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.0047eb0c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47f35c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5b1b4c
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.0047e860
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.0047e860
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
cmp si, 0x40
jbe 0x47f3c9
push esi
push edi
push ebx
call fcn.0047f120
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.0047f1d0
add esp, 8
push ebx
call fcn.0047e860
pop ecx
jmp 0x47f3da
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x47f3df
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.0047f120
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x47f3fc
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.0047f120
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f55c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push 0x10
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.0047f62c
add esp, 0xc
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0047f62c
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov edx, eax
mov eax, dword [ebp + 8]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 0x10
jb 0x47f595
xor eax, eax
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x30]
mov al, byte [eax + 0x5b1b8c]
inc ecx
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
cmp ecx, 0x30
jb 0x47f5ad
lea edx, [esi + eax]
inc esi
and edx, 0xff
cmp esi, 0x12
mov eax, edx
jb 0x47f5a8
push 0x10
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0047f62c
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 0xc
xor esi, esi
mov al, byte [edx + 0xf]
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov edx, dword [ebp + 0x10]
xor ebx, ebx
inc esi
mov bl, byte [edx]
inc edx
xor eax, ebx
mov al, byte [eax + 0x5b1b8c]
xor byte [ecx], al
mov al, byte [ecx]
inc ecx
and eax, 0xff
cmp esi, 0x10
jb 0x47f5f8
push 0x30
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.0047f654
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47f674
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4857f8
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
pop ebp
ret

Function at 0x48605c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov eax, dword [ebp + 8]
test eax, eax
jge 0x486076
neg eax
mov dword [0x5b1e34], eax
mov eax, 1
mov edx, dword [0x5b1e34]
xor ecx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x5b1e48
mov dword [ebp - 0x10], 0x5b1e38
mov dword [ebp - 0xc], eax
mov ecx, eax
mov edx, dword [ebp - 0x10]
xor ecx, dword [edx]
mov edx, ecx
mov eax, ecx
shr edx, 0x10
and eax, 0xffff
mov ebx, eax
mov ecx, edx
imul ecx, edx
imul ebx, eax
imul edx
not ecx
add ebx, ecx
mov edx, dword [ebp - 0xc]
mov ecx, ebx
and ebx, 0xffff
shl ebx, 0x10
shr ecx, 0x10
or ecx, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, dword [ebx]
add ecx, eax
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], edx
inc dword [ebp - 8]
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 4
mov eax, ecx
jb 0x486092
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f0ec
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
cmp eax, 0x20
jbe 0x48f105
or eax, 0xffffffff
jmp 0x48f1e8
mov edx, dword [ebp + 8]
mov dword [edx + 0xb0], eax
shr eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], 0xb7e15163
mov esi, 1
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc esi
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
cmp esi, 0x2c
jb 0x48f128
xor esi, esi
lea edx, [ebp - 0x2c]
mov eax, ecx
cmp esi, dword [ebp - 4]
jae 0x48f158
mov ecx, dword [eax]
mov dword [edx], ecx
inc esi
add edx, 4
add eax, 4
cmp esi, dword [ebp - 4]
jb 0x48f148
xor eax, eax
mov esi, eax
mov ebx, eax
mov edi, eax
cmp esi, 0x84
jae 0x48f1e6
mov eax, esi
xor edx, edx
mov ecx, 0x2c
div ecx
mov dword [ebp - 8], edx
xor edx, edx
mov eax, esi
inc esi
div dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add edx, edi
add edx, ebx
shl edx, 3
add edi, dword [ecx + eax*4]
add edi, ebx
mov eax, dword [ebp - 0xc]
shr edi, 0x1d
mov ecx, 0x20
or edx, edi
mov edi, edx
add ebx, edi
mov edx, ebx
and edx, 0x1f
sub ecx, edx
mov edx, dword [ebp + eax*4 - 0x2c]
add edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
mov ecx, ebx
add ebx, dword [ebp + eax*4 - 0x2c]
and ecx, 0x1f
shl ebx, cl
or edx, ebx
mov ecx, dword [ebp - 8]
mov ebx, edx
mov edx, dword [ebp + 8]
cmp esi, 0x84
mov dword [edx + ecx*4], edi
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2c], ebx
jb 0x48f168
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49392c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
lea ecx, [ebp + 9]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 5
jl 0x493936
xor eax, eax
lea ecx, [ebp + 0xe]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 0x12
jl 0x493944
mov eax, edx
pop ebp
ret

Function at 0x493954
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x49397c
mov eax, 0xa0100002
jmp 0x493a35
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 0xb
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0
lea edx, [ebp - 0x20]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x4939c2
call fcn.0049392c
mov ecx, ebx
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 8], al
add ecx, ebx
lea ecx, [ebx + ecx*8]
add ecx, ecx
add ecx, 0x5c8d32
push ecx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push edx
push ebx
call fcn.004933b4
mov ecx, ebx
add esp, 0xc
shl ecx, 4
mov dword [ebp - 4], eax
add ecx, ebx
lea ecx, [ebx + ecx*8]
add ecx, ecx
add ecx, 0x5c8d32
push ecx
call fcn.00496630
pop ecx
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 4
jl 0x493a23
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x493a3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x493a66
mov eax, 0xa0100002
jmp 0x493b16
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 0xc
mov ecx, eax
xor edi, edi
mov byte [ebp - 0x1a], cl
lea edx, [ebp - 0x16]
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
inc eax
xor bl, cl
inc edi
mov byte [edx], bl
inc edx
cmp edi, 4
jl 0x493aa4
lea edx, [ebp - 0x1c]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x493abe
call fcn.0049392c
mov ecx, esi
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 4], al
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x5c8d32
push ecx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x1c]
push edx
push esi
call fcn.004933b4
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8