joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49de20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx edx, word [eax]
push ebx
mov ebx, dword [ecx + 0x14]
push ebp
push esi
movzx esi, word [eax + 4]
push edi
movzx edi, word [eax + 2]
mov dword [esp + 0x18], edx
movzx edx, word [eax + 6]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0
mov bp, dx
mov cx, si
nop
mov eax, edx
not eax
and eax, edi
mov edi, edx
and edi, esi
add eax, edi
add ax, word [ebx]
add ax, word [esp + 0x18]
rol ax, 1
movzx eax, ax
mov edi, eax
not edi
and edi, esi
mov esi, edx
and esi, eax
add edi, esi
add di, word [ebx + 2]
mov dword [esp + 0x18], eax
add di, word [esp + 0x14]
rol di, 2
movzx edi, di
mov esi, edi
not esi
and esi, edx
mov edx, edi
and edx, eax
add esi, edx
add si, word [ebx + 4]
mov dword [esp + 0x14], edi
add si, cx
rol si, 3
movzx esi, si
mov ecx, esi
not ecx
and ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, esi
and edx, edi
add ecx, edx
add cx, word [ebx + 6]
mov dword [esp + 0x10], esi
add cx, bp
rol cx, 5
movzx edx, cx
mov dword [esp + 0x28], edx
cmp eax, 4
je 0x49deec
cmp eax, 0xa
jne 0x49df7f
mov bp, word [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
movzx edx, bp
and edx, 0x8000003f
jns 0x49df08
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x18]
add cx, word [eax + edx*2]
movzx edx, cx
and edx, 0x8000003f
mov word [esp + 0x18], cx
jns 0x49df26
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x14]
add cx, word [eax + edx*2]
mov word [esp + 0x14], cx
movzx ecx, cx
mov edx, ecx
and edx, 0x8000003f
jns 0x49df46
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x10]
add cx, word [eax + edx*2]
movzx edx, cx
and edx, 0x8000003f
mov word [esp + 0x10], cx
jns 0x49df64
dec edx
or edx, 0xffffffc0
inc edx
add bp, word [eax + edx*2]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov word [esp + 0x28], bp
mov edx, dword [esp + 0x28]
jmp 0x49df89
mov bp, word [esp + 0x28]
mov cx, word [esp + 0x10]
inc eax
add ebx, 8
mov dword [esp + 0x1c], eax
cmp eax, 0x10
jne 0x49de60
mov eax, dword [esp + 0x2c]
movzx edx, word [esp + 0x18]
pop edi
mov word [eax], dx
movzx edx, word [esp + 0x10]
pop esi
mov word [eax + 6], bp
pop ebp
mov word [eax + 2], dx
mov word [eax + 4], cx
pop ebx
add esp, 0x14
ret 8
Function at 0x49dfd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
push ebx
movzx ebx, word [eax + 4]
push ebp
movzx ebp, word [eax + 2]
movzx eax, word [eax + 6]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], ecx
lea ecx, [eax + 0x78]
push esi
add eax, 0x7c
mov dword [esp + 0x2c], edx
push edi
mov di, word [esp + 0x30]
mov dword [esp + 0x1c], eax
mov ax, word [esp + 0x18]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], ecx
mov dx, bx
mov si, bp
mov ecx, ebx
and ebx, ebp
ror ax, 5
not ecx
and ecx, dword [esp + 0x30]
sub ax, cx
mov ecx, dword [esp + 0x1c]
sub ax, bx
sub ax, word [ecx + 2]
ror dx, 3
movzx eax, ax
mov ebx, ebp
not ebx
and ebx, eax
sub dx, bx
mov ebx, ebp
mov ebp, dword [esp + 0x30]
and ebx, ebp
sub dx, bx
sub dx, word [ecx]
ror si, 2
movzx ebx, dx
mov edx, ebp
not edx
and edx, ebx
sub si, dx
mov edx, eax
and edx, ebp
sub si, dx
sub si, word [ecx - 2]
mov edx, dword [esp + 0x20]
mov ecx, eax
movzx ebp, si
ror di, 1
not ecx
and ecx, ebp
sub di, cx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
and eax, ebx
sub di, ax
sub di, word [edx]
mov dword [esp + 0x10], ebx
movzx eax, di
mov dword [esp + 0x14], ebp
mov dword [esp + 0x30], eax
cmp ecx, 4
je 0x49e0bc
cmp ecx, 0xa
jne 0x49e142
mov edx, dword [esp + 0x28]
mov ebx, dword [edx + 0x14]
mov dx, word [esp + 0x10]
movzx eax, dx
mov esi, eax
and esi, 0x8000003f
jns 0x49e0da
dec esi
or esi, 0xffffffc0
inc esi
mov ax, word [esp + 0x18]
sub ax, word [ebx + esi*2]
mov si, word [esp + 0x14]
movzx edi, si
and edi, 0x8000003f
jns 0x49e0f8
dec edi
or edi, 0xffffffc0
inc edi
sub dx, word [ebx + edi*2]
mov di, word [esp + 0x30]
movzx ebp, di
and ebp, 0x8000003f
mov word [esp + 0x10], dx
jns 0x49e116
dec ebp
or ebp, 0xffffffc0
inc ebp
sub si, word [ebx + ebp*2]
movzx ebp, ax
and ebp, 0x8000003f
mov word [esp + 0x14], si
jns 0x49e12f
dec ebp
or ebp, 0xffffffc0
inc ebp
sub di, word [ebx + ebp*2]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov word [esp + 0x30], di
jmp 0x49e156
mov ax, word [esp + 0x18]
mov dx, word [esp + 0x10]
mov si, word [esp + 0x14]
mov di, word [esp + 0x30]
sub dword [esp + 0x1c], 8
sub dword [esp + 0x20], 8
inc ecx
mov dword [esp + 0x24], ecx
cmp ecx, 0x10
jne 0x49e027
mov ecx, dword [esp + 0x34]
mov word [ecx], di
pop edi
mov word [ecx + 2], si
pop esi
pop ebp
mov word [ecx + 4], dx
mov word [ecx + 6], ax
pop ebx
add esp, 0x1c
ret 8
Function at 0x49e240
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0049e190
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp esi, eax
ja 0x49e25f
mov eax, esi
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
call fcn.0045e5f0
add esp, 0xc
mov eax, esi
cmp esi, 0x80
je 0x49e2b4
lea esp, [esp]
mov ecx, dword [esp + 0xc]
movzx ebx, byte [ecx + eax - 1]
mov edx, ecx
sub edx, esi
movzx edx, byte [edx + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x49e2a3
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + 0x4f93b0]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x80
jne 0x49e280
mov eax, dword [esp + 0xc]
sub eax, esi
movzx ecx, byte [eax + 0x80]
mov dl, byte [ecx + 0x4f93b0]
mov ecx, 0x7f
sub ecx, esi
mov byte [eax + 0x80], dl
js 0x49e2fc
jmp 0x49e2e0
mov eax, dword [esp + 0xc]
movzx ebx, byte [eax + ecx + 1]
add eax, ecx
movzx edx, byte [eax + esi]
xor edx, ebx
dec ecx
mov dl, byte [edx + 0x4f93b0]
mov byte [eax], dl
jns 0x49e2e0
xor eax, eax
mov edi, edi
mov edx, dword [esp + 0xc]
mov dx, word [eax + edx]
mov ecx, dword [edi + 0x14]
mov word [eax + ecx], dx
add eax, 2
cmp eax, 0x80
jne 0x49e300
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esp + 0x10]
push edx
call eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x49e3c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x14]
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov edx, dword [edi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
add eax, dword [esi]
mov esi, dword [esi + 4]
add esi, dword [edi + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
add edi, 0xc
mov dword [esp + 0x14], 5
jmp 0x49e400
lea ebp, [eax + eax + 1]
imul ebp, eax
lea eax, [esi + esi + 1]
imul eax, esi
rol ebp, 5
rol eax, 5
mov ecx, eax
and ecx, 0x1f
xor eax, edx
mov ebx, ebp
xor ebx, dword [esp + 0x20]
add edi, 0x20
rol ebx, cl
mov ecx, ebp
and ecx, 0x1f
add ebx, dword [edi - 0x24]
rol eax, cl
lea edx, [ebx + ebx + 1]
imul edx, ebx
add eax, dword [edi - 0x20]
mov ecx, eax
lea eax, [ecx + ecx + 1]
imul eax, ecx
rol eax, 5
rol edx, 5
mov dword [esp + 0x20], ecx
mov ebp, eax
xor ebp, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x1f
rol ebp, cl
xor edx, esi
mov ecx, eax
and ecx, 0x1f
add ebp, dword [edi - 0x1c]
rol edx, cl
lea esi, [ebp + ebp + 1]
imul esi, ebp
add edx, dword [edi - 0x18]
lea eax, [edx + edx + 1]
imul eax, edx
rol eax, 5
rol esi, 5
mov dword [esp + 0x10], edx
mov ecx, esi
and ecx, 0x1f
mov edx, eax
xor edx, dword [esp + 0x20]
xor esi, ebx
rol edx, cl
mov ecx, eax
and ecx, 0x1f
add edx, dword [edi - 0x14]
rol esi, cl
lea eax, [edx + edx + 1]
imul eax, edx
add esi, dword [edi - 0x10]
lea ebx, [esi + esi + 1]
imul ebx, esi
rol ebx, 5
rol eax, 5
mov dword [esp + 0x20], esi
mov ecx, eax
and ecx, 0x1f
mov esi, ebx
xor esi, dword [esp + 0x10]
xor eax, ebp
rol esi, cl
mov ecx, ebx
and ecx, 0x1f
add esi, dword [edi - 0xc]
rol eax, cl
add eax, dword [edi - 8]
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x49e400
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x14]
mov edi, dword [ecx + 0xa8]
add edx, dword [ecx + 0xac]
mov ecx, dword [esp + 0x24]
add edi, dword [esp + 0x20]
mov dword [ecx + 0xc], esi
mov dword [ecx], edi
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
pop ebx
add esp, 0xc
ret 8
Function at 0x49e510
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
push ebx
mov ebx, dword [ecx + 0x14]
push ebp
push esi
mov esi, dword [edx + 0xc]
push edi
mov edi, dword [edx + 8]
sub edi, dword [ebx + 0xac]
mov dword [esp + 0x10], esi
mov esi, dword [edx]
sub esi, dword [ebx + 0xa8]
mov ebp, ebx
mov dword [esp + 0x20], ecx
lea ecx, [ebp + 0x98]
add ebp, 0x9c
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 5
nop
sub eax, dword [ebp + 8]
lea ebx, [esi + esi + 1]
imul ebx, esi
rol ebx, 5
lea edx, [edi + edi + 1]
imul edx, edi
mov edi, dword [esp + 0x28]
rol edx, 5
mov ecx, ebx
and ecx, 0x1f
ror eax, cl
sub esi, dword [ebp]
mov ecx, edx
and ecx, 0x1f
xor eax, edx
mov edx, dword [esp + 0x10]
sub edx, dword [edi + 8]
mov ebp, dword [esp + 0x28]
ror edx, cl
lea edi, [eax + eax + 1]
imul edi, eax
xor edx, ebx
lea ebx, [edx + edx + 1]
imul ebx, edx
rol ebx, 5
rol edi, 5
mov ecx, ebx
and ecx, 0x1f
ror esi, cl
mov ecx, edi
and ecx, 0x1f
xor esi, edi
mov edi, dword [esp + 0x14]
sub edi, dword [ebp]
mov ebp, dword [esp + 0x18]
ror edi, cl
sub edx, dword [ebp - 8]
lea ecx, [esi + esi + 1]
imul ecx, esi
xor edi, ebx
lea ebx, [edi + edi + 1]
imul ebx, edi
rol ebx, 5
rol ecx, 5
mov dword [esp + 0x14], ecx
mov ecx, ebx
and ecx, 0x1f
ror edx, cl
mov ecx, dword [esp + 0x14]
sub edi, dword [ebp - 0x10]
sub ebp, 0x20
xor edx, ecx
and ecx, 0x1f
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x28]
sub eax, dword [edx - 8]
mov dword [esp + 0x18], ebp
ror eax, cl
mov ecx, dword [esp + 0x10]
xor eax, ebx
lea edx, [eax + eax + 1]
imul edx, eax
lea ebx, [ecx + ecx + 1]
imul ebx, ecx
rol edx, 5
rol ebx, 5
mov ecx, edx
and ecx, 0x1f
ror edi, cl
mov ecx, ebx
and ecx, 0x1f
xor edi, ebx
mov ebx, dword [esp + 0x28]
sub esi, dword [ebx - 0x10]
sub ebx, 0x20
ror esi, cl
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebx
xor esi, edx
dec dword [esp + 0x1c]
jne 0x49e560
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov edx, dword [esp + 0x10]
sub edx, dword [ecx + 4]
sub eax, dword [ecx]
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 8], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], edx
pop ebx
add esp, 0x14
ret 8
Function at 0x49e680
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x4e5a68
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, ecx
mov ebx, dword [esp + 0x3c]
mov ecx, dword [ebp + 0x18]
lea eax, [ebx - 1]
shr eax, 2
inc eax
mov dword [esp + 0x3c], eax
cmp eax, ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
jb 0x49e6cb
lea eax, [esp + 0x3c]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xb7e15163
mov eax, 1
cmp dword [ebp + 0x18], eax
je 0x49e706
jmp 0x49e6f0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4 - 4]
sub edx, 0x61c88647
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebp + 0x18]
jne 0x49e6f0
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
push 1
mov dword [esp + 0x34], edi
call fcn.0047ffd0
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
add esp, 4
push edi
push edi
mov ecx, esi
mov dword [esp + 0x2c], esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 0x20
mov ecx, esi
call edx
mov ecx, eax
lea eax, [ebx - 1]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], 0xffffffff
cmp eax, edi
jl 0x49e773
mov esi, dword [esp + 0x38]
movzx esi, byte [eax + esi]
mov edx, eax
shr edx, 2
mov ebx, dword [ecx + edx*4]
lea edx, [ecx + edx*4]
shl ebx, 8
add esi, ebx
dec eax
mov dword [edx], esi
jns 0x49e756
xor ebx, ebx
xor esi, esi
cmp dword [esp + 0x14], edi
je 0x49e7c3
lea ecx, [ecx]
xor edx, edx
mov eax, ebx
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
add esi, edi
add esi, dword [eax + edx*4]
rol esi, 3
lea eax, [eax + edx*4]
mov dword [esp + 0x38], eax
xor edx, edx
mov eax, ebx
div dword [esp + 0x3c]
inc ebx
lea eax, [ecx + edx*4]
lea ecx, [edi + esi]
add edi, dword [eax]
and ecx, 0x1f
add edi, esi
rol edi, cl
mov ecx, dword [esp + 0x38]
mov dword [ecx], esi
mov ecx, dword [esp + 0x18]
mov dword [eax], edi
cmp ebx, dword [esp + 0x14]
jne 0x49e780
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
push 0x20
push ecx
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x49e7f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edi, eax
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [edx + 0xc]
mov ebp, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
bswap eax
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 8
mov edx, dword [esi + 4]
xor edx, dword [esp + 0x20]
xor edx, ebp
mov ecx, edx
mov eax, edx
shr ecx, 0x10
shr eax, 0x18
movzx ebx, cl
mov ecx, dword [eax*4 + 0x505810]
xor ecx, dword [ebx*4 + 0x505410]
mov eax, edx
shr eax, 8
movzx edx, dl
movzx eax, al
xor ecx, dword [eax*4 + 0x505010]
mov eax, dword [esi]
xor ecx, dword [edx*4 + 0x504c10]
xor eax, ebp
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x505810]
xor edx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x505010]
movzx eax, al
xor edx, dword [eax*4 + 0x504c10]
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
xor ecx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505010]
mov ebx, dword [esp + 0x10]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
mov eax, dword [esi + 0xc]
xor ebx, ecx
add ecx, edx
xor eax, ebx
xor edi, ecx
xor eax, edi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
xor ecx, dword [edx*4 + 0x505410]
mov edx, eax
shr edx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x505010]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], ebx
xor eax, edi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x505810]
xor edx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x505010]
movzx eax, al
xor edx, dword [eax*4 + 0x504c10]
add esi, 0x10
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505010]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
xor dword [esp + 0x20], ecx
add ecx, edx
xor ebp, ecx
dec dword [esp + 0x14]
jne 0x49e845
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x14]
bswap eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0xc
ret 8
Function at 0x49ea00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov esi, eax
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x14], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [edx + 0xc]
mov edi, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
bswap eax
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0x70]
mov dword [esp + 0x20], eax
add ebp, 0x74
mov dword [esp + 0x18], 8
nop
mov edx, dword [ebp + 8]
xor edx, dword [esp + 0x10]
xor edx, edi
mov eax, edx
mov ecx, edx
shr eax, 0x10
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
movzx eax, al
xor ecx, dword [eax*4 + 0x505410]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505010]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 8]
movzx edx, dl
xor ecx, dword [edx*4 + 0x504c10]
xor eax, edi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x505810]
xor edx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x505010]
movzx eax, al
xor edx, dword [eax*4 + 0x504c10]
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505010]
mov ebx, dword [esp + 0x14]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
mov eax, dword [ebp]
xor ebx, ecx
add ecx, edx
xor eax, ebx
xor esi, ecx
xor eax, esi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
xor ecx, dword [edx*4 + 0x505410]
mov edx, eax
shr edx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x505010]
mov edx, dword [esp + 0x20]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
mov eax, dword [edx]
mov dword [esp + 0x14], ebx
xor eax, esi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x505810]
movzx ebx, bl
xor edx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x505010]
movzx eax, al
xor edx, dword [eax*4 + 0x504c10]
sub dword [esp + 0x20], 0x10
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x505810]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505410]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x505010]
movzx eax, al
xor ecx, dword [eax*4 + 0x504c10]
sub ebp, 0x10
xor dword [esp + 0x10], ecx
add ecx, edx
xor edi, ecx
dec dword [esp + 0x18]
jne 0x49ea60
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x20]
bswap eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0xc
ret 8
Function at 0x4a25f0
Capabilities:
Encode data using xor
Encrypt data using skipjack

Disassembly:
push ebx
push esi
lea esi, [ecx + 0x14]
mov ecx, dword [esp + 0xc]
push edi
add ecx, 9
mov edi, 0xa
xor eax, eax
movzx edx, byte [ecx]
mov ebx, dword [esi]
xor edx, eax
mov dl, byte [edx + 0x4f94d0]
mov byte [eax + ebx], dl
inc eax
cmp eax, 0x100
jne 0x4a2604
dec ecx
add esi, 0x10
dec edi
jne 0x4a2602
pop edi
pop esi
pop ebx
ret 8
Function at 0x4a3720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
push 1
mov dword [esp + 0x54], ebx
call fcn.0047ffd0
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
add esp, 4
push ebx
push ebx
mov ecx, esi
mov dword [esp + 0x4c], esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
mov edi, 4
push edi
mov ecx, esi
call edx
mov ebp, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x50], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
push 1
mov byte [esp + 0x54], 2
call fcn.0047ffd0
mov edi, eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
add esp, 4
push ebx
push ebx
mov ecx, edi
mov dword [esp + 0x3c], edi
call edx
mov eax, dword [edi]
mov edx, dword [eax]
push 4
mov ecx, edi
call edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [edx + eax*4]
mov ecx, 4
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x50], 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [esp + 0x28]
mov dword [ebp], eax
mov eax, 0x4f95d0
sub eax, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x4a3825
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
xor ebp, ebp
add eax, ecx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x38]
mov cl, byte [edx + ebp]
mov eax, dword [esp + 0x18]
mov al, byte [eax]
cmp cl, bl
je 0x4a3870
cmp al, bl
je 0x4a3870
movzx edx, al
movzx eax, byte [edx + 0x505e10]
movzx ecx, cl
movzx edx, byte [ecx + 0x505e10]
add eax, edx
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [esp + 0x14]
mov dl, byte [edx + 0x505f10]
xor byte [eax], dl
add dword [esp + 0x18], 4
inc ebp
cmp ebp, 4
jne 0x4a3831
mov eax, 1
add dword [esp + 0x14], eax
sub dword [esp + 0x20], eax
jne 0x4a3821
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
bswap eax
mov edx, dword [esp + 0x58]
mov ebp, dword [esp + 0x1c]
mov dword [edx + ebp*4], eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
push 4
push ecx
mov ecx, edi
call edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, dword [eax + 4]
push 4
push ecx
mov ecx, esi
mov dword [esp + 0x58], 0xffffffff
call edx
inc ebp
mov dword [esp + 0x1c], ebp
cmp ebp, 4
jne 0x4a374d
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret