joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4790f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8cdc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00478f20
mov ecx, dword [esi + 0x8cdc]
cmp byte [ecx + 0x1a8], bl
je 0x47916c
mov eax, dword [esi + 0x8cf0]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cec]
call fcn.0049a9a0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x4791a9
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8cdc]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x47917e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8cdc]
push edx
call fcn.00479280
mov edi, dword [esi + 0x8cdc]
cmp byte [edi + 0x1a8], bl
je 0x479269
mov ebp, dword [esi + 0x8cf0]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x4791f4
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x479245
lea ecx, [edi + 0x148]
call fcn.00410908
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8cdc]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8cdc]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cec]
call fcn.0049aac0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x487920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x48795e
mov ecx, ebx
call fcn.004a3f00
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.004a4eb0
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.004a4600
jmp 0x487976
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x48797f
mov ecx, ebx
call fcn.004a3f00
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.004a4eb0
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x4879ad
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.004a3f00
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.004a4eb0
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x487a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.004a46e0
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.004a46e0
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x487afa
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004a4740
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.004a4740
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x487a8f
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x488a90
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x488ac1
lea ecx, [esp + 0x4c]
call fcn.004a3f00
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.004a4eb0
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.004a4600
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4
Function at 0x491c70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or edx, 0x100
push ebx
lea esp, [esp]
mov ecx, edx
and ecx, 1
shr edx, 1
movzx ebx, word [edi + edx*2]
neg ecx
shr ecx, 4
shr ebx, 4
and ecx, 0x7f
xor ebx, ecx
add eax, dword [esi + ebx*4]
cmp edx, 2
jae 0x491c80
pop ebx
ret

Function at 0x491cb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
shr ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x491cc0
pop esi
pop ebp
pop ebx
ret 4

Function at 0x491fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
push esi
mov esi, edx
shr esi, 1
mov ebp, esi
and ebp, 1
mov eax, edx
shr eax, 2
movzx ecx, word [ebx + eax*2 + 4]
neg ebp
shr ebp, 4
neg eax
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
movzx ebp, word [ebx + 2]
mov ecx, dword [edi + ecx*4]
and eax, 0x7f0
xor eax, ebp
shr eax, 4
add ecx, dword [edi + eax*4]
movzx eax, word [ebx + esi*2 + 8]
add ecx, dword [esp + 0xc]
mov esi, eax
shr esi, 4
mov ebp, dword [edi + esi*4]
mov esi, dword [esp + 0x10]
xor eax, 0x7f0
add ebp, ecx
shr eax, 4
mov dword [esi + edx*4], ebp
mov eax, dword [edi + eax*4]
add eax, ecx
mov dword [esi + edx*4 + 4], eax
add edx, 2
cmp edx, 8
jb 0x491fc4
pop esi
pop ebp
ret 8
Function at 0x492040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, eax
movzx eax, word [ebp]
mov ecx, eax
xor ecx, 0x7f0
shr ecx, 4
mov edx, dword [edi + ecx*4]
movzx ecx, word [ebp + 0x10]
shr eax, 4
mov eax, dword [edi + eax*4]
mov dword [esp + 0x18], eax
shr ecx, 4
mov eax, dword [edi + ecx*4]
add eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], edx
test eax, eax
je 0x4920c5
mov esi, dword [esp + 0x24]
add esi, 4
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x18]
push esi
push edx
mov ebx, ebp
call fcn.00491fc0
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0x20]
push eax
push ecx
lea ebx, [ebp + 0x10]
call fcn.00491fc0
add esi, 0x440
add ebp, 0x20
dec dword [esp + 0x14]
jne 0x492090
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov esi, dword [eax]
cmp esi, 0x10
jbe 0x492197
movzx ecx, word [ebp + 0x10]
xor ecx, 0x7f0
add esi, 0xfffffff1
shr esi, 1
shr ecx, 4
add edx, dword [edi + ecx*4]
lea eax, [ebp + esi*2 + 0x300]
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], eax
jmp 0x492104
mov edx, dword [esp + 0x10]
dec esi
sub dword [esp + 0x2c], 2
lea ecx, [esi + 0x80]
mov eax, ecx
and eax, 1
shr ecx, 1
movzx ebx, word [ebp + ecx*2 + 0x200]
neg eax
shr eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edx, dword [edi + ebx*4]
cmp ecx, 2
jae 0x492110
mov ecx, dword [esp + 0x2c]
movzx eax, word [ecx]
mov ebx, dword [esp + 0x24]
mov ecx, eax
shr ecx, 4
mov ecx, dword [edi + ecx*4]
xor eax, 0x7f0
add ebx, 0x44
add ecx, edx
shr eax, 4
mov dword [ebx + esi*8], ecx
mov eax, dword [edi + eax*4]
add eax, edx
mov dword [ebx + esi*8 + 4], eax
test esi, esi
jne 0x492100
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ebp, dword [ecx]
lea ebp, [ebp*4 - 0x40]
cmp eax, 1
jbe 0x492197
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
push ebp
push ebx
push esi
call fcn.004a5278
add esp, 0xc
add esi, 0x440
dec edi
jne 0x492183
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x494c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [edx + 0x2c], ebx
push esi
push edi
mov edi, 1
mov dword [edx + 0x44], edi
mov dword [edx + 0x40], edi
mov dword [edx + 0x3c], edi
mov dword [edx + 0x38], edi
mov eax, dword [edx + 0x78]
mov dword [edx + 0x70], eax
mov eax, 0x400
movzx ecx, ax
mov dword [edx + 0x58], 0xffffffff
mov dword [edx + 0x5c], ebx
mov dword [edx + 0x60], ebx
mov dword [edx + 0x64], ebx
mov dword [edx + 0x68], ebx
mov dword [edx + 0x6c], ebx
mov dword [edx + 0x80], ebx
mov dword [edx + 0x84], ebx
mov dword [edx + 0x88], ebx
mov eax, ecx
shl ecx, 0x10
or eax, ecx
mov dword [edx + 0x1e30], eax
mov dword [edx + 0x1e34], eax
mov dword [edx + 0x1e38], eax
mov dword [edx + 0x1e3c], eax
mov dword [edx + 0x1e40], eax
mov dword [edx + 0x1e44], eax
mov dword [edx + 0x1e48], eax
mov dword [edx + 0x1e4c], eax
lea ecx, [edx + 0x1e68]
lea eax, [edx + 0x2030]
mov dword [esp + 0xc], 0xc
push ebp
lea esp, [esp]
mov esi, 0x10
jmp 0x494cf0
mov ebp, 0x400
mov word [eax - 0x180], bp
mov word [eax], bp
add eax, 2
sub esi, edi
jne 0x494cf0
mov esi, ebp
mov word [ecx - 0x18], si
mov word [ecx], si
mov word [ecx + 0x18], si
mov word [ecx + 0x30], si
add ecx, 2
sub dword [esp + 0x10], edi
jne 0x494ce0
mov eax, esi
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x21b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov eax, ebp
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x23b0]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x98]
add ecx, dword [edx + 0x94]
mov edi, dword [edx + 0x50]
mov eax, 0x300
shl eax, cl
cmp eax, ebx
jbe 0x494d83
mov ecx, eax
mov eax, ebp
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, ebp
movzx ebp, ax
mov eax, ebp
shl ebp, 0x10
or eax, ebp
mov ecx, 0x80
lea edi, [edx + 0x24b0]
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x26b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx ebp, ax
mov eax, ebp
shl ebp, 0x10
or eax, ebp
mov ecx, 0x80
lea edi, [edx + 0x28b0]
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x2ab0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [edx + 0x1c], ebx
mov dword [edx + 0x18], ebx
lea eax, [edx + 0xbcb8]
mov ecx, 0x800
pop ebp
mov dword [eax], 0x40000000
add eax, 0x20
dec ecx
jne 0x494e02
mov ecx, dword [edx + 0x9c]
mov eax, 1
shl eax, cl
mov ecx, dword [edx + 0x98]
mov esi, 0x100
pop edi
dec eax
mov dword [edx + 0x4c], eax
mov eax, 0x100
shl eax, cl
mov ecx, dword [edx + 0x94]
shr esi, cl
mov dword [edx + 0x34], ebx
sub eax, esi
pop esi
mov dword [edx + 0x48], eax
pop ebx
pop ecx
ret
Function at 0x495f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x495f9b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x495fdc
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x495fc1
mov ecx, ebx
call fcn.00495c20
add ebx, 0x28
dec ebp
jne 0x495fb5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x495fd7
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00495af0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.00496080
mov ebx, eax
cmp ebx, edi
jne 0x49603f
lea ecx, [ebp + 0x20]
call fcn.0049aac0
mov ebx, eax
cmp ebx, edi
jne 0x49603f
lea ecx, [ebp + 0x1c]
call fcn.0049aac0
mov ebx, eax
cmp ebx, edi
jne 0x49603f
push ebp
call fcn.004960c0
mov ebx, eax
cmp ebx, edi
je 0x496054
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.004960a0
cmp ebx, edi
jle 0x49604f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x496054
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x496066
cmp dword [esi + 0x40], edi
jne 0x496066
cmp dword [esi + 0x3c], edi
jne 0x496066
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x497090
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call fcn.004a5426
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x4970eb
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
lea esp, [esp]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x497130
lea edx, [esi + 0x9fc]
mov dword [esp + 8], edx
push ebp
jmp 0x497160
mov edi, dword [esp + 0xc]
xor ebp, ebp
jmp 0x497170
movzx eax, word [ebp + 0x4b9a20]
xor edx, edx
lea ecx, [ebx + 2]
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ebx, [ebx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x497190
add ebp, 2
add edi, 2
cmp ebp, 0x10
jb 0x497170
sub dword [esp + 0xc], 0xffffff80
inc ebx
cmp ebx, 0x80
jb 0x497160
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
pop ebp
mov eax, edi
mov edx, 0x10
jmp 0x4971d0
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x4971d0
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x4971c4
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
pop ecx
ret
Function at 0x498c00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x100]
push ebx
push eax
call fcn.004a5426
push 0x98
lea ecx, [esi + 0x198]
push ebx
push ecx
call fcn.004a5426
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0x18
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x498c70
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
mov dword [esi + 0x3c], eax
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov dword [eax], 0x10100ff
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x498ca6
lea eax, [esi + 0x330]
lea edx, [esi + 0x1048]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jmp 0x498ce4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
movzx edx, byte [eax]
cmp edx, ecx
jne 0x498d03
nop
inc ebx
lea eax, [esi + ebx + 0x330]
mov dword [esp + 0x14], eax
movzx eax, byte [eax]
cmp eax, ecx
je 0x498cf0
mov edi, dword [esp + 0x10]
xor ebp, ebp
lea esp, [esp]
movzx eax, word [ebp + 0x4b9a40]
xor edx, edx
lea ecx, [ebx + 1]
div ecx
mov ecx, 0x4000
sub ecx, eax
movzx ecx, cx
xor eax, eax
lea ebx, [ebx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x498d30
add ebp, 2
add edi, 2
cmp ebp, 0x10
jb 0x498d10
mov eax, dword [esp + 0xc]
sub dword [esp + 0x10], 0xffffff80
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x19
jb 0x498ce0
xor edi, edi
lea edx, [esi + 0x448]
lea ebp, [esi + 0x333]
lea ebx, [edi + 3]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x18
movzx eax, byte [ebp]
cmp eax, ebx
jne 0x498d94
nop
inc edi
movzx ecx, byte [esi + edi + 0x333]
lea ebp, [esi + edi + 0x333]
cmp ecx, ebx
je 0x498d80
mov eax, dword [esp + 0x10]
mov ecx, edi
shl ecx, 4
add ecx, 0x28
mov edx, 0x20
jmp 0x498db0
mov word [eax], cx
mov word [eax + 2], 0x703
add eax, 4
dec edx
jne 0x498db0
sub dword [esp + 0x10], 0xffffff80
inc ebx
dec dword [esp + 0x14]
jne 0x498d77
pop edi
pop ebp
mov dword [esi + 0x444], 0x40070000
pop ebx
add esp, 0xc
ret
Function at 0x49b400
Capabilities:
Hash data using sha256

Disassembly:
mov eax, edx
mov dword [ecx], eax
dec eax
je 0x49b423
sub eax, 3
je 0x49b419
sub eax, 6
jne 0x49b42a
add ecx, 0x10
jmp fcn.004a4890
or eax, 0xffffffff
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
mov dword [ecx + 4], 0xffffffff
ret
Function at 0x4a3ed0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
ret

Function at 0x4a3f00
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [0x4c865c]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
ret

Function at 0x4a4600
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x4a4642
cmp eax, 0x40
je 0x4a4634
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call fcn.004a5426
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call fcn.004a5426
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
mov ecx, dword [esi + 0x20]
bswap ecx
mov dword [edi], ecx
mov edx, dword [esi + 0x24]
bswap edx
mov dword [edi + 4], edx
mov eax, dword [esi + 0x28]
bswap eax
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x2c]
bswap ecx
mov dword [edi + 0xc], ecx
mov edx, dword [esi + 0x30]
bswap edx
mov dword [edi + 0x10], edx
pop edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x67452301
mov dword [esi + 0x24], 0xefcdab89
mov dword [esi + 0x28], 0x98badcfe
mov dword [esi + 0x2c], 0x10325476
mov dword [esi + 0x30], 0xc3d2e1f0
pop esi
pop ebx
ret

Function at 0x4a4840
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4a4890
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x4c8660]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret
Function at 0x4a4f40
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x4a4f83
cmp eax, 0x40
je 0x4a4f75
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call fcn.004a5426
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call fcn.004a5426
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x4a4fc8
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret