joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x4227a1
cmp al, 3
jb 0x42277b
call fcn.0041e430
test eax, eax
jne 0x422789
cmp byte [esi + 0x42], 0
jne 0x42278d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4227a1
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x422787
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x42285a
cmp byte [edx + 5], 0
jne 0x4227e5
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.00421f90
test eax, eax
jne 0x422789
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00422150
mov cl, byte [esi + 0x44]
xor eax, eax
test cl, cl
je 0x42284c
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x422815
call fcn.00419140
jmp 0x42281a
call fcn.004153e0
mov ecx, edi
call fcn.0041a2e0
movsx eax, byte [esi + 0x44]
mov ecx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [ecx + 0x12]
jae 0x4227e5
cmp byte [ecx + 2], 0
je 0x422787
push ebx
push esi
call fcn.00422870
add esp, 8
pop edi
pop esi
pop ebx
ret
mov dword [ebx], 1
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
ret
cmp byte [edx + 5], 0
je 0x4227db
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4228e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x422921
cmp al, 3
jb 0x4228fb
call fcn.0041e430
test eax, eax
jne 0x422909
cmp byte [esi + 0x42], 0
jne 0x42290d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x422921
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x422907
movsx eax, byte [esi + 0x44]
mov edi, dword [esi + eax*4 + 0x78]
cmp byte [edi + 5], 0
jne 0x422965
movzx ecx, word [esi + eax*2 + 0x50]
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00421f90
test eax, eax
jne 0x422909
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00422200
cmp word [esi + eax*2 + 0x50], 0
jne 0x4229b8
nop dword [eax]
mov cl, byte [esi + 0x44]
xor eax, eax
test cl, cl
je 0x4229f0
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x4229a0
call fcn.00419140
jmp 0x4229a5
call fcn.004153e0
mov ecx, edi
call fcn.0041a2e0
movsx eax, byte [esi + 0x44]
cmp word [esi + eax*2 + 0x50], 0
je 0x422970
movsx eax, byte [esi + 0x44]
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x422907
cmp byte [eax + 5], 0
jne 0x422907
push ebx
push esi
call fcn.00422a00
add esp, 8
pop edi
pop esi
pop ebx
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
ret
Function at 0x42e100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00421a50
mov edi, dword [esi + 0x10]
mov edx, edi
mov eax, dword [esi + 0x14]
add edx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x42e1cf
jb 0x42e13b
cmp edx, 0x7ffffffe
ja 0x42e1cf
mov esi, dword [ebx]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [esi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovb ecx, eax
cmp edi, ecx
ja 0x42e17e
mov eax, 0x1010
mov dword [ebp - 0x20], edx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x24], edi
jmp 0x42e19b
lea eax, [ebp - 0x30]
xor edx, edx
push eax
push 1
push edi
mov ecx, esi
call fcn.004297c0
add esp, 0xc
test eax, eax
jne 0x42e1f6
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.0042d740
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x28], 0x2460
mov dword [ecx], eax
jne 0x42e1be
cmp dword [ebp - 0x18], 0
je 0x42e1c6
lea ecx, [ebp - 0x30]
call fcn.00428e90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x63cc14
push 0x11195
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.0040ed50
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f980
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x66a030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x48f9a0
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.0048f8b0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0048f8b0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x48fa10
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.005c8b9d
mov esp, ebp
pop ebp
ret 4

Function at 0x4910a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef36a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x66a030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.005eb6a9
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x491160
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.005ce378
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x664d38
push eax
call fcn.005cbf6a
push edi
push esi
call fcn.005eb9f1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8b9d
mov esp, ebp
pop ebp
ret 4
Function at 0x496ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
nop dword [eax]
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x34]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, dword [edi + 0x64]
cmp dword [edi + 0x64], eax
jb 0x496b6c
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.005cb890
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
nop dword [eax + eax]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x496b3f
sub eax, esi
jmp 0x496b41
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x496b30
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x496b60
sub eax, esi
jmp 0x496b62
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x496b51
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x496bc4
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00496e40
add dword [edi + 0x6c], eax
add esp, 0xc
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x496bb0
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x496bc4
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x496af0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4985c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x4985dc
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4986e1
nop dword [eax + eax]
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x4986a4
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x498616
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x4986b5
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x4986a8
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x4985f0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4986f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4986fc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00498710
Function at 0x460355
Capabilities:
Reference http user-agent string

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
je 0x460442
push ebx
push ebp
push esi
push 0x60
push 8
push dword [0x29fcb30]
call dword [0x29fa288]
push dword [esp + 0x18]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call fcn.00440acf
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call fcn.00440acf
mov ebx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [0x29f8370]
mov dword [esi + 0x28], eax
mov eax, dword [0x29fd788]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x46042f
test ebx, ebx
je 0x4603f9
push ebx
push edi
push dword [0x29fcb30]
call dword [0x29fa288]
mov dword [esi + 0x48], eax
test eax, eax
je 0x4603f4
push ebx
push dword [esp + 0x20]
push eax
call fcn.00440a45
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x460426
lea eax, [esp + 0x18]
push eax
push edi
push esi
push 0x460448
push 0x10000
push edi
call dword [0x29fa280]
test eax, eax
je 0x46041e
push eax
call dword [0x29fa240]
jmp 0x460422
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x46043d
push esi
call fcn.0045febb
pop ecx
jmp 0x46043f
mov eax, dword [esp + 0x1c]
push esi
mov dword [esi + 0x48], eax
call fcn.0045ff4c
pop ecx
mov edi, esi
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 0x18
Function at 0x46e2d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call fcn.0046e4b0
mov ebp, eax
add esp, 0xc
xor ebx, ebx
lea edi, [ebp*4]
test edi, edi
jle 0x46e349
mov ecx, dword [esp + 0x14]
lea esi, [esi + edi*4]
add esi, 8
add ecx, 8
mov edx, dword [ecx - 8]
lea ecx, [ecx + 0x10]
mov eax, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [ecx - 0x18], eax
add ebx, 4
mov eax, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [ecx - 0x14]
mov dword [ecx - 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [ecx - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x46e305
mov esi, dword [esp + 0x14]
cmp ebp, 1
jle 0x46e4a9
add esi, 2
lea edi, [ebp - 1]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x520e30]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521630]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521230]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521a30]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x520e30]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521630]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521230]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521a30]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x520e30]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521630]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521230]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521a30]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x520e30]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521630]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521230]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x521a30]
mov dword [esi + 0xa], ecx
dec edi
jne 0x46e358
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x46e9a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x34
cdq
and edx, 0xf
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
lea edi, [edx + eax]
sar edi, 4
and ebp, 0x8000000f
jns 0x46e9ca
dec ebp
or ebp, 0xfffffff0
inc ebp
mov dword [esp + 0x1c], ebp
je 0x46e9df
test edi, edi
jne 0x46e9de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
dec edi
mov eax, dword [esp + 0x58]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x4c], esi
mov esi, dword [eax + 0xc]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
test edi, edi
je 0x46ea72
mov ebp, dword [esp + 0x48]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x50], eax
push esi
push ebx
push dword [ebp + 4]
lea eax, [ebp + 0xf8]
push eax
call fcn.0046d700
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [eax + esi + 8]
add esi, 0x10
mov edx, dword [ebx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0xc]
add ebx, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
dec edi
jne 0x46ea12
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
test ebp, ebp
je 0x46eb3a
mov edi, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [ebp], edi
mov edi, ebp
mov dword [esp + 0x2c], ecx
mov dword [edi + 4], edx
lea edx, [esp + 0x34]
push edx
mov dword [edi + 0xc], eax
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x4c]
push edx
mov dword [edi + 8], ecx
push dword [eax + 4]
lea ecx, [eax + 0xf8]
push ecx
mov dword [esp + 0x30], ecx
call fcn.0046d700
mov ebp, dword [esp + 0x2c]
add esp, 0x10
test ebp, ebp
je 0x46eafa
mov eax, esi
lea edi, [ebx + 0x10]
sub eax, ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x50], eax
mov ebx, eax
mov al, byte [edi]
lea edi, [edi + 1]
mov cl, byte [edx]
lea edx, [edx + 1]
xor cl, al
mov byte [edx - 1], al
mov byte [ebx + edi - 1], cl
dec ebp
jne 0x46eae4
push esi
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push dword [eax + 4]
push dword [esp + 0x2c]
call fcn.0046d700
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
pop esi
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
pop ebp
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x48]
pop ebx
add esp, 0x34
ret
Function at 0x477183
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x477239
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x477219
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x4771f4
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x47722e
add edi, dword [esp + 0x14]
jmp 0x477232
add edi, dword [esp + 0x24]
test edx, edx
jne 0x4771d2
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x477544
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x47761e
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x4775f4
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x4775bc
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x47760b
add edi, ecx
jmp 0x47760f
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x477592
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x477c3e
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x477cf3
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x477cd4
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x477caf
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x477ce9
add edx, dword [esp + 0x14]
jmp 0x477ced
add edx, dword [esp + 0x24]
test esi, esi
jne 0x477c8d
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24