joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454428
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004545d8
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x454526
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4544c9
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x45450c
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4544e0
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4544fb
test al, 0x40
je 0x4544f2
mov ecx, dword [edi + 0x20]
jmp 0x4544f9
test al, 0x80
je 0x45450c
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x45450c
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x454498
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x1d
sub esp, 8
mov byte [0x4c3044], al
inc esp
xor byte [eax + eax - 0x5f], cl
cmp al, 0x30
dec esp
add byte [ebx - 0x1e3ea938], cl
add al, 0x23
sal dword [ebx], 1
leave

Function at 0x417e29
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x1d
sub esp, 8
mov byte [0x4c3044], al
inc esp
xor byte [eax + eax - 0x5f], cl
cmp al, 0x30
dec esp
add byte [ebx - 0x1e3ea938], cl
add al, 0x23
sal dword [ebx], 1
leave

Function at 0x417e41
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [ecx + 0x4c303815], cl
add byte [ebx + 0x4c303415], cl
adc eax, 0x4c3034
xor esi, esi
and edx, 8
loop 0x417e5b
imul edx, ecx

Function at 0x417e51
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [ecx + 0x4c303815], cl
add byte [ebx + 0x4c303415], cl
adc eax, 0x4c3034
xor esi, esi
and edx, 8
loop 0x417e5b
imul edx, ecx

Function at 0x417e89
Capabilities:
Query or enumerate registry value

Disassembly:
dec esp
add byte [ebx - 0x74efdbb4], cl
push esp
and al, 4
mov dword [0x4c6abc], eax
lea eax, [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417ebc
mov esi, 1
mov eax, dword [esp + 4]
push eax

Function at 0x445eb9
Capabilities:
Authenticate hmac

Disassembly:
outsd dx, dword [esi]
imul esi, ecx, 0xffffffd2
sbb edi, dword [ecx - 0x3f6ea466]
mov bl, pe_nt_image_headers32
lahf
loopne 0x445f20
lcall 0x809c, 0x56846adf
jb 0x445e85
and byte [ecx + 0x54], bh

Function at 0x445ec1
Capabilities:
Authenticate hmac

Disassembly:
test byte [esi - 0x64], dl
xor byte [edx - 0x42], 0x20
jns 0x445f1e
jg 0x445ec8

Function at 0x445ec9
Capabilities:
Authenticate hmac

Disassembly:
push esp
pop dword [ecx + 0x5c6be5b1]
outsd dx, dword [esi]
ffreep st(7)
out dx, eax
into
fnsave dword [esi + esi - 0x7e1b452]
xchg dword [edx + 0x13], ebp
push 0x13
mov ch, 0xfa
mov ch, 0x77
fld dword [ecx + 0x4e]
or eax, 0x3e8cb23b
mov ebx, 0xb5421561
ret 0x17

Function at 0x445ed9
Capabilities:
Authenticate hmac

Disassembly:
jle 0x445f39
cli
lcall 0x7b7a, 0x1fe82ceb
sub al, 0xe8
pop ds
jp fcn.00445f59
sub al, 0xe8
pop ds
jp fcn.00445f59
and eax, dword [eax]
loop fcn.00445e71
jae 0x445ed4
imul ebp, dword [ebp + ecx + 0x1be1947a], 0xffffff80
push 0x3f
jle 0x445eec
imul ebx, dword [eax], 0xffffffc4
inc edi
sub eax, dword [eax - 0x50b33b24]
scasd eax, dword es:[edi]
mov ebp, dword [ecx]
ja 0x445f6c
mov bh, 0xc8
in al, dx
sub dword [eax], edx
test dh, bh
xchg ecx, eax
or byte [ebx], dh
call 0xd6f7e2f
pop es
push ss
mov eax, dword [0x13278909]
or dword [ecx + 0x9f51327], ecx
push 0xffffffffffffff93
ljmp 0xe699:0x157490b3
Function at 0x47d3e9
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
and byte [ecx + 0x61], dh
inc ecx
pushfd
dec edx
fisttp dword [edi]
rcl byte [edi + 0x5e], 0x9a
enter 0x1d9f, 0x1f
mov al, 0x36
mov eax, dword [0xbd0bc5bb]
wait
int 0x76
leave
pushal
dec esp
adc eax, 0xf5e24b81
pop edx
ror ebx, cl
push ss
arpl word [esi - 0x7d440064], bx
in al, 0xe
and ah, 0xe
dec esp
fstp qword [ecx - 0x58f9532e]
xchg esp, eax
out dx, eax
pushfd
aam 0x6c
insb byte es:[edi], dx
insb byte es:[edi], dx
pop eax
xor dword [edi + 0x69], edx
lahf
imul ebx, dword [ecx - 0x3e], 0xffffffcb
imul ebp, dword [edi], 0x5f1937f1
push 0x474e2c9f
adc al, byte [edi]
pop edi
cmp byte [esi + 0xdd70f1b], bl
imul dword [ebx + 0x63]
popfd
lea edx, [edi + edi*2 - 0x61]
jg 0x47d3ae
stosd dword es:[edi], eax
salc
jae 0x47d3da
inc ebx
outsb dx, byte [esi]
std
sbb esi, eax
jns 0x47d40d
mov bl, 0x6f
xor edi, ebp
mov edi, 0x5bb5b0f9
and byte [edi], bl
cmp eax, 0xcc7a314f
lcall 0xbb53, 0xb13929e8
out 0x1b, eax
outsd dx, dword [esi]
test dword [ebx], 0x384f7baf
sbb dword [ebx - 0x3074978a], esp
cmpsd dword [esi], dword es:[edi]
add dword [esi + edx*4 - 0x26bc76d2], eax
sahf
mov dword [0xedbc49b0], eax
daa
xchg ah, bl
xchg ecx, eax
cmp bl, ah
stosb byte es:[edi], al
call 0x76bc3450
mov al, byte [edi - 0x441c0c41]
jg 0x47d48b
pop ebx
pop ss
jnp 0x47d498
lea edi, [eax]
repne scasb al, byte es:[edi]
test al, 0x64
push edi
mov cl, 0xb7
pushal
lcall 0x15d3, 0xb2941ce7
aas
mov ebp, 0x4a66fc47
fist word [ecx]
imul edx, dword [ebx], 0xdf952916
mov bl, 0x60
push ebp
or dl, byte [edi]
popfd
sbb dh, byte [ebx]
clc
stosb byte es:[edi], al
sbb al, 0xa0
call 0x297db52
popal
fmulp st(2)
mov dh, 0x21
iretd
retf 0x21b6
Function at 0x4af401
Capabilities:
Encode data using xor

Disassembly:
jg 0x4af415
outsd dx, dword [esi]
out dx, al
fsub dword gs:[ecx]
inc edx
jmp 0x9a701ed0
adc eax, 0xbbf545aa
push edx
aam 0xd2
pop ss
push eax
xor al, 0xc6
salc
ret 0x10e5

Function at 0x4bb581
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3378
cmp edx, dword [eax]
je 0x4bb5a3
add eax, 8
inc ecx
cmp eax, 0x4c3408
jl 0x4bb594
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3378]
jne 0x4bb6d1
mov eax, dword [0x4c7cfc]
cmp eax, 1
je 0x4bb6ab
test eax, eax
jne 0x4bb5d4
cmp dword [0x4c32a0], 1
je 0x4bb6ab
cmp edx, 0xfc
je 0x4bb6d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb60b
lea eax, [ebp - 0x1a4]
push 0x4c09b8
push eax
call fcn.004bbf60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc3f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb64e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc3f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09b4
push edi
call fcn.004be2c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0998
push eax
call fcn.004bbf60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbf70
lea eax, [ebp - 0xa0]
push 0x4c0994
push eax
call fcn.004bbf70
push dword [esi + 0x4c337c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbf70
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c096c
push eax
call fcn.004be234
add esp, 0x2c
pop edi
jmp 0x4bb6d1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c337c]
push 0
push eax
push dword [esi]
call fcn.004bc3f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x75c243
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebx, edx
bswap ecx
rol ecx, 0xbf
add ebp, edx
pop eax
jmp fcn.006d25b7
call fcn.005deeab
mov eax, 0x3ab3171d
lea ebp, [ebp + eax - 0x3ab31721]
mov eax, dword [eax + ebp - 0x3ab3171d]
mov edx, 0x8f30f424
xor eax, ebx
lea ecx, [edx + edx*4 - 0x7de88346]
not eax
btc dx, 8
or dx, dx
neg eax
lea ecx, [edx*8 + 0x1abbfad]
xor dl, ch
xchg cx, dx
lea eax, [eax + edx + 0x3f06e3a]
call fcn.006e0030
movzx edx, word [ebp]
call fcn.00643d96
mov edx, 0x5d83d51b
lea ecx, [edx + edx*2 - 0xf4db850]
movsx eax, dl
mov al, byte [edx + ebp - 0x5d83d51b]
shl edx, cl
push ecx
mov cl, byte [ecx + ebp - 0x93dc6ff]
xor edx, dword [esp]
call fcn.00657aff
mov eax, 0x64b31884
imul eax, eax
sub ax, ax
mov dx, word [ebp + eax - 0x6af10000]
sar ax, 0xce
jbe 0x693c6f
ror edx, 1
dec ecx
dec edx
shr eax, cl
imul ecx, ecx
neg edx
rol cl, 0x64
cwde
xor ebx, edx
add esi, edx
jmp esi
shr dx, cl
mov word [ebp + eax - 0x6af10000], dx
movsx ecx, al
movsx edx, cl
call fcn.00437166
rol eax, 0x57
mov edx, dword [eax + ebp - 0x5119d29d]
mov eax, dword [ebp + eax - 0x5119d299]
mov ecx, dword [ebp + 8]
jb 0x5cd4b8
sal ecx, 0xa2
not ax
je 0x642a1e
xor ecx, ecx
shr ecx, 0x92
rol ax, 1
push edx
neg ax
add ax, 0xe00b
lea edx, [ecx*8 + 0x293d2b0e]
shr byte [esp + ecx + 3], 0x24
xor bx, ax
shr ecx, 0x2c
lea esi, [ecx + esi - 2]
jne 0x75eaf0
mov word [esi + ecx], ax
call fcn.006ef108
mov ecx, 0x61be3604
mov edx, dword [edx + edi - 0x5216e609]
mov eax, ecx
lea edi, [edi + ecx - 0x61be3600]
btr ecx, eax
imul ecx, eax
xor edx, ebx
push eax
dec edx
ror ax, 0x45
mov byte [esp + ecx - 0x4155b00e], al
ror edx, 2
lea eax, [ecx + eax*4 - 0x397d69d6]
not ecx
neg edx
dec word [esp]
xor eax, ecx
dec edx
xor eax, eax
jp 0x5c8a16
mov cl, byte [ebp + eax - 0x6af0fffe]
lea ebp, [eax + ebp - 0x6af0fffe]
bt eax, 3
sal ax, 0x2b
jns 0x5f0d1c
lea eax, [eax*4 + 0x1405cab5]
xor ebx, ecx
imul eax
add edi, ecx
mov dword [esp + edx - 0x190e7cd], edi
ret 0xc
mov dword [esp + 4], 0x4aa8af4a
lea esp, [esp + 4]
call fcn.00713fe9
mov eax, 0x33a53aa2
jmp 0x5ffb7a
xor edx, ebx
sub ax, 0x4e8b
bswap edx
lea edx, [edx + ecx - 0x49b49a7c]
neg ecx
not edx
xadd eax, ecx
adc eax, eax
jg 0x5d08f8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x30e20242
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x34595de8
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x423a14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x423a1a
ret

Function at 0x4304c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x430679
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405468
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x430690
call fcn.004050c4
mov eax, ebx
call fcn.00421950
mov edi, eax
dec edi
test edi, edi
jl 0x430580
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00421924
mov edx, dword [0x444814]
call fcn.00404060
test al, al
je 0x43057c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00421924
lea edx, [ebp - 0x14]
call fcn.0045079c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405468
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405138
inc esi
dec edi
jne 0x43052e
mov al, byte [0x430694]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4306a0
mov eax, dword [ebp - 0xc]
call fcn.0040e4f8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404e50
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045079c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x430690
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0045079c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x430690
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x430690
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4306ac
call fcn.0040a4a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430680
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404ddc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404ddc
lea eax, [ebp - 0x14]
call fcn.00404db8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ddc
ret
Function at 0x47fbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405268
xor eax, eax
push ebp
push 0x47fc9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405078
mov ebx, eax
sar ebx, 1
jns 0x47fc20
adc ebx, 0
test ebx, ebx
jle 0x47fc7c
mov edi, 1
lea eax, [ebp - 0x14]
push eax
mov eax, edi
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004052d8
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x47fcb8
call fcn.004050c4
mov eax, dword [ebp - 0x10]
call fcn.00409720
xor edx, edx
mov dl, byte [ebp - 5]
xor eax, edx
lea ecx, [ebp - 0xc]
mov edx, 2
call fcn.004096c8
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405080
inc edi
dec ebx
jne 0x47fc29
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fca6
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ddc
lea eax, [ebp - 4]
call fcn.00404db8
ret
Function at 0x47fcbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x47fcc5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405268
mov eax, dword [ebp - 8]
call fcn.00405268
xor eax, eax
push ebp
push 0x47fed3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404db8
mov edx, dword [ebp - 4]
mov eax, 0x47feec
call fcn.004053bc
test eax, eax
jle 0x47fd36
mov al, byte [0x47fef0]
push eax
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x47feec
mov eax, dword [ebp - 4]
call fcn.0040e4f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404e50
mov edx, dword [ebp - 4]
mov eax, 0x47fefc
call fcn.004053bc
test eax, eax
jle 0x47fd6b
mov al, byte [0x47fef0]
push eax
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x47fefc
mov eax, dword [ebp - 4]
call fcn.0040e4f8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404e50
mov eax, dword [ebp - 4]
call fcn.00405078
push eax
mov eax, dword [ebp - 8]
call fcn.00405078
pop edx
xchg edx, eax
mov ecx, edx
cdq
idiv ecx
mov esi, eax
dec esi
test esi, esi
jl 0x47fe13
inc esi
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.00405078
push eax
mov eax, dword [ebp - 8]
call fcn.00405078
mov edx, eax
imul edx, dword [ebp - 0xc]
inc edx
mov eax, dword [ebp - 4]
pop ecx
call fcn.004052d8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x47ff08
call fcn.004050c4
mov eax, dword [ebp - 0x1c]
call fcn.00409720
mov edi, eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x47ff08
call fcn.004050c4
mov eax, dword [ebp - 0x24]
call fcn.00409720
xor edi, eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405078
mov edx, eax
lea ecx, [ebp - 0x18]
pop eax
call fcn.004096c8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00405080
inc dword [ebp - 0xc]
dec esi
jne 0x47fd96
mov eax, dword [ebp - 4]
call fcn.00405078
push eax
mov eax, dword [ebp - 8]
call fcn.00405078
pop edx
xchg edx, eax
mov ecx, edx
cdq
idiv ecx
mov esi, edx
test esi, esi
je 0x47feab
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.00405078
mov edx, eax
imul edx, dword [ebp - 0xc]
inc edx
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.004052d8
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x47ff08
call fcn.004050c4
mov eax, dword [ebp - 0x2c]
call fcn.00409720
mov edi, eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004052d8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x47ff08
call fcn.004050c4
mov eax, dword [ebp - 0x34]
call fcn.00409720
xor edi, eax
mov eax, edi
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.004096c8
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47feda
lea eax, [ebp - 0x38]
mov edx, 0xb
call fcn.00404ddc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ddc
ret
Function at 0x48de9c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, 0x4d522c
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x48ded1
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x48ded8
add edi, 7
sar edi, 3
mov ebx, dword [esp]
mov bl, byte [ebx + edi]
and bl, byte [edx + 0x4d52a4]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x48debf
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x4d5294
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x48df23
mov dl, byte [esp + edi + 0x1c]
mov byte [eax], dl
mov dl, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x48df2f
mov dl, byte [esp + edi]
mov byte [eax], dl
mov dl, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x48df0a
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.00403718
xor ecx, ecx
mov ebp, 0x4d5264
xor eax, eax
mov al, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x48df7e
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
xor eax, eax
mov al, byte [edx + 0x4d52a4]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x48df4d
cmp byte [esp + 8], 0
je 0x48dfe9
xor eax, eax
mov al, byte [esp + 9]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xd]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
xor eax, eax
mov al, byte [esp + 0xa]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xe]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x48e05c
xor edx, edx
mov dl, byte [esp + 9]
shl edx, 0x18
xor ecx, ecx
mov cl, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
xor edx, edx
mov dl, byte [esp + 0xa]
shl edx, 0x18
xor ecx, ecx
mov cl, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x48df04
mov eax, dword [esp + 4]
mov dl, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48e234
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], edx
mov edi, eax
mov ebx, 0x4d52ac
lea esi, [esp + 4]
lea ecx, [esp + 8]
mov edx, esi
mov eax, dword [esp]
call fcn.0048e0e8
lea edx, [esp + 8]
mov eax, esi
call fcn.0048e138
mov dword [esp + 0xc], edi
mov edx, 8
mov eax, dword [esp + 8]
shr eax, 4
mov ecx, dword [esp + 8]
shl ecx, 0x1c
or eax, ecx
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx]
add dword [esp + 0xc], 4
mov ecx, eax
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x600]
xor dword [esi], ecx
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x400]
xor dword [esi], ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x200]
xor dword [esi], ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esi], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
xor eax, dword [esp + 8]
add dword [esp + 0xc], 4
mov ecx, eax
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x700]
xor dword [esi], ecx
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x500]
xor dword [esi], ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x300]
xor dword [esi], ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esi], eax
mov eax, dword [esi]
shr eax, 4
mov ecx, dword [esi]
shl ecx, 0x1c
or eax, ecx
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx]
add dword [esp + 0xc], 4
mov ecx, eax
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x600]
xor dword [esp + 8], ecx
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x400]
xor dword [esp + 8], ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x200]
xor dword [esp + 8], ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
xor eax, dword [esi]
add dword [esp + 0xc], 4
mov ecx, eax
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x700]
xor dword [esp + 8], ecx
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x500]
xor dword [esp + 8], ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
mov ecx, dword [ebx + ecx*4 + 0x300]
xor dword [esp + 8], ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esp + 8], eax
dec edx
jne 0x48e26a
lea edx, [esp + 8]
mov eax, esi
call fcn.0048e1b4
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov eax, dword [esi]
call fcn.0048e114
add esp, 0x10
pop edi
pop esi
pop ebx
ret