joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2faa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
dec eax
and eax, ecx
shr eax, 0x1f
dec eax
mov ecx, dword [edx + 4]
mov edi, dword [esi + 4]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 4], ecx
xor dword [esi + 4], edi
mov ecx, dword [edx + 0xc]
mov edi, dword [esi + 0xc]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 0xc], ecx
xor dword [esi + 0xc], edi
mov ecx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
mov ebx, dword [esi + 0x10]
xor ebx, edi
and ebx, eax
and ebx, 4
xor edi, ebx
mov dword [edx + 0x10], edi
xor dword [esi + 0x10], ebx
test ecx, ecx
jle 0x2fab6f
mov edx, dword [edx]
mov esi, dword [esi]
xor edi, edi
cmp ecx, 4
jb 0x2fab13
lea ebx, [edx + ecx*4]
mov dword [esp], ebx
lea ebp, [esi + ecx*4]
cmp edx, ebp
setb bl
cmp esi, dword [esp]
setb bh
test bl, bh
jne 0x2fab13
mov edi, ecx
and edi, 0x7ffffffc
movd xmm0, eax
pshufd xmm0, xmm0, 0
xor ebx, ebx
nop word [eax + eax]
movdqu xmm1, xmmword [edx + ebx*4]
movdqu xmm2, xmmword [esi + ebx*4]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm0
pxor xmm1, xmm3
movdqu xmmword [edx + ebx*4], xmm1
pxor xmm3, xmm2
movdqu xmmword [esi + ebx*4], xmm3
add ebx, 4
cmp edi, ebx
jne 0x2faae0
cmp edi, ecx
je 0x2fab6f
mov ebx, edi
test cl, 1
je 0x2fab31
mov ebx, dword [edx + edi*4]
mov ebp, dword [esi + edi*4]
xor ebp, ebx
and ebp, eax
xor ebx, ebp
mov dword [edx + edi*4], ebx
xor dword [esi + edi*4], ebp
mov ebx, edi
or ebx, 1
lea ebp, [ecx - 1]
cmp edi, ebp
je 0x2fab6f
nop dword [eax + eax]
mov edi, dword [edx + ebx*4]
mov ebp, dword [esi + ebx*4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4], edi
xor dword [esi + ebx*4], ebp
mov edi, dword [edx + ebx*4 + 4]
mov ebp, dword [esi + ebx*4 + 4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4 + 4], edi
xor dword [esi + ebx*4 + 4], ebp
add ebx, 2
cmp ecx, ebx
jne 0x2fab40
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x359ae0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x359b0b
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x359af7
neg eax
shr eax, 0x1f
pop edi
pop esi
ret
Function at 0x35ff10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x36005b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x35ff71
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push 0x7c2de0
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.0034cae0
add esp, 0x10
test eax, eax
je 0x36006d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0x7c2dc0]
movdqa xmm1, xmmword [0x7c2dd0]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x35ff90
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x360065
Function at 0x38e110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x38e13d
mov eax, dword [eax]
test eax, eax
je 0x38e13d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x38e13d
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x38e1f2
push ebp
call fcn.004f8b98
add esp, 4
mov esi, eax
test ebx, ebx
je 0x38e18a
push ebx
call fcn.004f8b98
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x38e18d
add esi, 6
add esi, 2
push 0x166
push 0x7dcd90
push esi
call fcn.0034c9b0
add esp, 0xc
test eax, eax
je 0x38e1f2
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.0034e850
add esp, 0xc
push esi
push ebp
push edi
call fcn.0034e8b0
add esp, 0xc
test ebx, ebx
je 0x38e1e1
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.0034e8b0
add esp, 0xc
push esi
push ebx
push edi
call fcn.0034e8b0
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.0034e8b0
add esp, 0xc
jmp 0x38e1f4
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3de138
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x3de33e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call fcn.004f8d80
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x3de297
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x3de1f3
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x3de297
cmp byte [esp + 0x10], 0
je 0x3de230
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x3de200
jmp 0x3de1e0
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x3de240
jmp 0x3de1e0
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x3de2a0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.003de340
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.00359a90
add esp, 8
push 0x400
push esi
call fcn.00359a90
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x3de323
push 0x310
push 0x7f7998
push ecx
push eax
call fcn.0034df30
jmp 0x3de334
push 0x313
push 0x7f7998
push ecx
push eax
call fcn.0034cd90
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4133f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
test esi, esi
sete al
mov ebp, edx
test edx, edx
sete dl
or dl, al
jne 0x41342b
movzx eax, byte [esi]
test byte [ecx + 5], 1
jne 0x413443
shr al, 7
xor ecx, ecx
mov ebx, eax
mov edx, ebp
jmp 0x413504
mov eax, 1
xor edx, edx
xor ebx, ebx
xor ecx, ecx
test edi, edi
jne 0x413512
jmp 0x4135a7
mov cl, 0xff
mov bl, 1
cmp al, 0x80
mov edx, ebp
ja 0x413504
xor ebx, ebx
neg al
jno 0x413504
cmp edx, 2
jb 0x413500
mov eax, 1
cmp edx, 9
jb 0x4134f0
lea ecx, [edx - 1]
mov edi, ecx
and edi, 0xfffffff8
lea eax, [edi + 1]
pxor xmm1, xmm1
mov edx, esi
xor esi, esi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax]
movd xmm3, dword [edx + esi + 1]
movd xmm4, dword [edx + esi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add esi, 8
cmp edi, esi
jne 0x413490
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd ebx, xmm0
cmp ecx, edi
mov esi, edx
mov edx, ebp
mov edi, dword [esp + 0x20]
je 0x4134fb
nop word cs:[eax + eax]
movzx ecx, byte [esi + eax]
or ebx, ecx
inc eax
cmp edx, eax
jne 0x4134f0
test ebx, ebx
setne bl
mov ecx, ebx
neg cl
movzx ebx, bl
lea eax, [edx + ebx]
test edi, edi
je 0x4135a7
mov edi, dword [edi]
test edi, edi
je 0x4135a7
mov dword [esp + 4], eax
mov byte [edi], cl
test edx, edx
je 0x41359d
add edi, ebx
add esi, edx
add edi, edx
mov dword [esp], edx
mov edx, ecx
and dl, 1
movzx ebx, dl
mov edx, dword [esp]
test dl, 1
mov ebp, esi
jne 0x41354a
mov eax, edx
cmp edx, 1
jne 0x413568
jmp 0x41359d
lea eax, [edx - 1]
movzx edx, byte [ebp - 1]
xor dl, cl
dec ebp
movzx edx, dl
add ebx, edx
mov edx, dword [esp]
mov byte [edi - 1], bl
dec edi
shr ebx, 8
cmp edx, 1
je 0x41359d
neg eax
xor esi, esi
nop dword [eax]
movzx edx, byte [ebp + esi - 1]
xor dl, cl
movzx edx, dl
add edx, ebx
mov byte [edi + esi - 1], dl
shr edx, 8
movzx ebx, byte [ebp + esi - 2]
xor bl, cl
movzx ebx, bl
add ebx, edx
mov byte [edi + esi - 2], bl
shr ebx, 8
add esi, 0xfffffffe
cmp eax, esi
jne 0x413570
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 4]
add dword [ecx], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4136a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4136e1
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x4136c1
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x413718
mov eax, 1
test ecx, ecx
je 0x413710
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x4136dd
neg dl
mov byte [ecx], dl
jmp 0x413710
call fcn.00327120
push 0x803ae2
push 0xa0
push 0x803a92
call fcn.00327220
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.00327310
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x4137bf
cmp edx, 0xff
jne 0x4137fa
cmp eax, 9
jae 0x41373d
xor edi, edi
mov edx, 1
jmp 0x4137b0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x413760
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x4137bb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x4137b0
test edi, edi
je 0x4137fa
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x4137fe
call fcn.00327120
push 0x803ae2
push 0xc1
push 0x803a92
call fcn.00327220
add esp, 0xc
push 0
push 0xdd
jmp 0x413704
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x413710
test eax, eax
je 0x41370e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x413830
mov edi, eax
cmp eax, 1
je 0x413710
jmp 0x41384e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x413710
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x413860
mov eax, dword [esp + 4]
jmp 0x413710
Function at 0x473230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov ecx, dword [ecx]
xor eax, eax
cmp ecx, 1
sbb eax, eax
mov dword [esp], eax
mov eax, 1
test ebx, ebx
je 0x4733ae
mov edx, dword [ebx]
test edx, edx
je 0x4733ae
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x3c]
mov dword [esp + 8], eax
or dword [esp], ecx
nop word [eax + eax]
xorps xmm0, xmm0
movsd qword [esp + 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [esp + 0x60], xmm1
movups xmmword [esp + 0x50], xmm1
movups xmmword [esp + 0x40], xmm1
movups xmmword [esp + 0x30], xmm1
movups xmmword [esp + 0x20], xmm1
movups xmmword [esp + 0x10], xmm1
lea eax, [esp + 0x88]
movsd qword [eax + 0x10], xmm0
movups xmmword [eax], xmm1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp]
mov dword [esp + 0x84], eax
mov dword [esp + 0x94], edx
lea ecx, [esp + 0x78]
mov edx, 0x819620
push 0x56
call fcn.004735d0
add esp, 4
mov esi, eax
mov edi, fcn.004729b0
test eax, eax
je 0x473317
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0x24]
test edi, edi
mov ecx, fcn.004729b0
cmove edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x10]
push eax
push esi
push 7
call edi
add esp, 0xc
mov ebp, eax
test eax, eax
jle 0x47335f
cmp dword [esp + 0x14], 0
je 0x47335f
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0xc]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00342590
add esp, 0x18
mov ebp, eax
test ebp, ebp
jle 0x473378
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x10]
push eax
push esi
push 8
call edi
add esp, 0xc
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x473393
push 0x2c9
push 0x8194ac
push eax
call fcn.0034cbc0
add esp, 0xc
test ebp, ebp
jle 0x4733ac
mov edx, dword [ebx + 0x14]
add ebx, 0x14
test edx, edx
jne 0x473280
mov eax, 1
jmp 0x4733ae
xor eax, eax
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47c440
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
test esi, esi
je 0x47c51f
mov ebx, dword [esp + 0x28]
test byte [edx + 0x5c], 2
mov eax, 0x81df2a
mov edi, esi
mov esi, 0x81dee9
cmove esi, eax
test edi, edi
jle 0x47c526
mov dword [esp + 4], esi
lea ebp, [edx + 9]
mov dword [esp], 4
mov esi, edi
nop dword [eax + eax]
movzx eax, byte [ebp - 1]
mov edi, eax
shl edi, 0x10
cmp esi, 2
mov dword [esp + 8], esi
jbe 0x47c535
movzx ebx, byte [ebp]
shl ebx, 8
movzx ecx, byte [ebp + 1]
mov dword [esp + 0xc], ecx
lea edx, [ebx + ecx]
or ebx, edi
shr eax, 2
mov esi, dword [esp + 4]
movzx eax, byte [esi + eax]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp]
mov byte [edi + ecx - 4], al
shr ebx, 0xc
and ebx, 0x3f
movzx eax, byte [esi + ebx]
mov byte [edi + ecx - 3], al
shr edx, 6
and edx, 0x3f
movzx eax, byte [esi + edx]
mov byte [edi + ecx - 2], al
mov eax, dword [esp + 0xc]
and eax, 0x3f
movzx eax, byte [esi + eax]
mov esi, dword [esp + 8]
mov byte [edi + ecx - 1], al
add ecx, 4
mov dword [esp], ecx
add ebp, 3
add esi, 0xfffffffd
jne 0x47c490
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
lea eax, [esi + ebx]
add eax, 0xfffffffc
add esi, 0xfffffffc
jmp 0x47c587
xor esi, esi
jmp 0x47c5a7
xor esi, esi
mov eax, ebx
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x47c598
jmp 0x47c59d
jne 0x47c540
movzx eax, byte [ebp]
shl eax, 8
or edi, eax
mov eax, edi
shr eax, 0x12
mov edx, dword [esp + 4]
movzx eax, byte [edx + eax]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
mov byte [ebx + esi - 4], al
mov eax, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [edx + eax]
mov byte [ebx + esi - 3], al
mov cl, 0x3d
cmp dword [esp + 8], 1
je 0x47c57b
shr edi, 6
and edi, 0x3f
movzx ecx, byte [edx + edi]
lea eax, [ebx + esi]
mov byte [ebx + esi - 2], cl
mov byte [ebx + esi - 1], 0x3d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov byte [eax], 0
test byte [edx + 0x5c], 1
jne 0x47c59d
mov byte [ebx + esi], 0xa
inc esi
mov byte [ebx + esi], 0
mov dword [edx], 0
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4abde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
xor esi, esi
test ebx, ebx
jle 0x4abe00
nop
movzx eax, byte [ecx + esi]
cmp al, byte [edx + esi]
jne 0x4abe00
inc esi
cmp ebx, esi
jne 0x4abdf0
mov esi, ebx
mov ebp, ebx
sar ebp, 0x1f
and ebp, ebx
lea eax, [ebp - 1]
mov dword [esp], eax
lea edi, [ebx - 1]
mov eax, ebx
lea ebx, [edi + 1]
test ebx, ebx
jle 0x4abe2d
cmp byte [ecx + edi], 0
jne 0x4abe3d
cmp byte [edx + edi], 0xff
lea edi, [edi - 1]
lea ebx, [eax - 1]
je 0x4abe10
jmp 0x4abe32
mov eax, ebp
mov ebx, dword [esp]
mov ebp, 0xffffffff
cmp esi, ebx
jge 0x4abe4a
jmp case.0x4abe6a.2
mov eax, ebx
mov ebx, edi
mov ebp, 0xffffffff
cmp esi, ebx
jl case.0x4abe6a.2
cmp esi, eax
jge 0x4abe78
movzx ecx, byte [ecx + esi]
movzx edx, byte [edx + esi]
mov ch, dl
xor ch, cl
movzx eax, ch
lea ebx, [eax - 1]
cmp ebx, 0x1e
ja case.default.0x4abe6a
mov edi, 7
jmp dword [ebx*4 + 0x826da8]
mov edi, 6
jmp case.0x4abe6a.1
shl esi, 3
mov ebp, esi
jmp case.0x4abe6a.2
cmp eax, 0x3f
je 0x4abea5
cmp eax, 0x7f
jne case.0x4abe6a.2
mov edi, 1
jmp case.0x4abe6a.1
mov edi, 5
jmp case.0x4abe6a.1
mov edi, 4
jmp case.0x4abe6a.1
mov edi, 3
jmp case.0x4abe6a.1
mov edi, 2
not dl
or cl, dl
test ch, cl
jne case.0x4abe6a.2
lea ebp, [edi + esi*8]
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b6600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebx + 4]
mov edi, eax
cmovl edi, ebx
cmovl ebx, eax
push dword [edi + 4]
push esi
call fcn.002f9cf0
add esp, 8
test eax, eax
je 0x4b665d
cmp dword [ebx + 4], 0
jle 0x4b6661
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ebp, dword [esi]
xor eax, eax
nop dword [eax]
mov esi, dword [edx + eax*4]
xor esi, dword [ecx + eax*4]
mov dword [ebp + eax*4], esi
inc eax
cmp eax, dword [ebx + 4]
jl 0x4b6640
mov ebx, dword [edi + 4]
cmp eax, ebx
mov ebp, dword [esp + 0x14]
jl 0x4b666e
jmp 0x4b668e
xor eax, eax
jmp 0x4b669f
xor eax, eax
mov ebx, dword [edi + 4]
cmp eax, ebx
mov ebp, dword [esp + 0x14]
jge 0x4b668e
mov ecx, dword [edi]
mov edx, dword [ebp]
nop word cs:[eax + eax]
mov esi, dword [ecx + eax*4]
mov dword [edx + eax*4], esi
inc eax
mov ebx, dword [edi + 4]
cmp eax, ebx
jl 0x4b6680
mov dword [ebp + 4], ebx
push ebp
call fcn.002fa7e0
add esp, 4
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c67a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], ecx
mov ebp, dword [esp + 0x28]
mov ecx, dword [ebp + 0x10c]
lea esi, [ebp + 0x114]
mov dword [ebp + 0x114], 0x3020100
inc ecx
cmp ecx, 3
mov edi, 2
cmovae edi, ecx
cmp ecx, 9
mov dword [esp + 4], esi
jae 0x4c67e9
mov eax, 1
mov ecx, 0x3020100
jmp 0x4c6868
mov dword [esp], edi
lea esi, [edi - 1]
mov edi, esi
and edi, 0xfffffff8
imul ecx, edi, 0x4040404
add ecx, 0x3020100
lea eax, [edi + 1]
movdqa xmm0, xmmword [0x830570]
xor ebx, ebx
movdqa xmm1, xmmword [0x830580]
movdqa xmm2, xmmword [0x830590]
movdqa xmm3, xmmword [0x8305a0]
nop word cs:[eax + eax]
movdqa xmm4, xmm0
paddd xmm4, xmm1
movdqa xmm5, xmm0
paddd xmm5, xmm2
movdqu xmmword [ebp + ebx*4 + 0x118], xmm4
movdqu xmmword [ebp + ebx*4 + 0x128], xmm5
add ebx, 8
paddd xmm0, xmm3
cmp edi, ebx
jne 0x4c6830
cmp esi, edi
mov esi, dword [esp + 4]
mov edi, dword [esp]
je 0x4c687e
add ecx, 0x4040404
nop
mov dword [esi + eax*4], ecx
inc eax
add ecx, 0x4040404
cmp edi, eax
jne 0x4c6870
test edx, edx
je 0x4c6897
lea ecx, [ebp + 0x113]
cmp edx, 1
mov dword [esp + 0xc], edx
jne 0x4c689e
xor esi, esi
xor ebx, ebx
jmp 0x4c690b
xor ebx, ebx
jmp 0x4c6940
and edx, 0xfffffffe
mov dword [esp + 0x10], edx
xor esi, esi
xor ebx, ebx
mov dword [esp], ecx
nop dword [eax]
mov edi, dword [esp + 8]
movzx ebp, byte [edi + esi]
mov edx, dword [esp + 4]
movzx eax, byte [edx + ebp]
mov byte [edi + esi], al
mov byte [ecx], al
lea eax, [ebp + 1]
push eax
push ecx
push edx
call fcn.004f8d88
add esp, 0xc
or ebx, ebp
movzx ebp, byte [edi + esi + 1]
mov edx, dword [esp + 4]
movzx eax, byte [edx + ebp]
mov byte [edi + esi + 1], al
mov ecx, dword [esp]
mov byte [ecx], al
lea eax, [ebp + 1]
push eax
push dword [esp + 4]
push edx
call fcn.004f8d88
mov ecx, dword [esp + 0xc]
add esp, 0xc
or ebx, ebp
add esi, 2
cmp dword [esp + 0x10], esi
jne 0x4c68b0
test byte [esp + 0xc], 1
je 0x4c6939
mov edx, dword [esp + 8]
movzx ebp, byte [edx + esi]
mov edi, ecx
mov ecx, dword [esp + 4]
movzx eax, byte [ecx + ebp]
mov byte [edx + esi], al
mov byte [edi], al
lea eax, [ebp + 1]
push eax
push edi
push ecx
call fcn.004f8d88
add esp, 0xc
or ebx, ebp
shr ebx, 2
mov ebp, dword [esp + 0x28]
mov dword [ebp + 0x10c], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e74a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x2c]
mov eax, 5
cmp edi, 5
jae 0x4e74bd
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
xorps xmm0, xmm0
movsd qword [ebp + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [ebp], xmm0
mov edx, dword [esi]
cmp edx, 0xfd2fb527
jne 0x4e7584
movzx ebx, byte [esi + 4]
cmp ebx, 0x40
setb al
mov ecx, ebx
and ecx, 3
mov edx, ebx
shr edx, 6
mov esi, ebx
and ebx, 0x20
mov dword [esp + 0xc], ebx
shr ebx, 5
mov dword [esp], ecx
mov ebp, dword [ecx*4 + 0x8527a0]
mov dword [esp + 4], edx
add ebp, dword [edx*4 + 0x8527b0]
sub ebp, ebx
mov ah, bl
mov ebx, dword [esp + 0x28]
and ah, al
movzx eax, ah
add eax, ebp
add eax, 6
mov ebp, dword [esp + 0x24]
cmp eax, edi
ja 0x4e74b5
mov eax, 0xfffffff2
mov edx, esi
test dl, 8
jne 0x4e74b5
cmp dword [esp + 0xc], 0
jne 0x4e75bf
movsx edi, byte [ebx + 5]
test edi, edi
js 0x4e74b5
mov dword [esp + 8], edx
mov ecx, edi
shr ecx, 3
mov ebx, 0x400
shl ebx, cl
mov ecx, ebx
shr ecx, 3
and edi, 7
imul edi, ecx
add edi, ebx
mov ebx, dword [esp + 0x28]
mov ecx, 6
mov edx, dword [esp]
jmp dword [edx*4 + 0x8524e0]
and edx, 0xfffffff0
mov eax, 0xfffffff6
cmp edx, 0x184d2a50
jne 0x4e74b5
mov eax, 8
cmp edi, 8
jb 0x4e74b5
mov eax, dword [esi + 4]
mov dword [ebp], eax
mov dword [ebp + 4], 0
xor edi, edi
mov eax, 8
jmp 0x4e767d
mov dword [esp + 8], edx
xor edi, edi
mov ecx, 5
mov edx, dword [esp]
jmp dword [edx*4 + 0x8524e0]
mov edx, dword [esp + 4]
jmp dword [edx*4 + 0x8524f0]
mov dword [ebp + eax], edi
xor eax, eax
jmp 0x4e74b5