joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005e38a0
mov eax, dword [esi + 0x160]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
cmp ebx, 0xc
jne 0x4b9f79
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov ecx, dword [ecx + 8]
mov dword [esi + 0xc], 0x1000000
lea ebx, [eax + 1]
jmp 0x4ba04f
lea edi, [esi + 0x40]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
cmp ebx, 0x10
jb 0x4b9ff1
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], eax
lea esp, [esp]
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x41]
inc ecx
mov dword [ebp - 4], 4
mov edi, edi
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec dword [ebp - 4]
jne 0x4b9fb0
lea eax, [esi + 0x60]
push eax
push edi
call dword [ebp + 0xc]
add dword [ebp + 8], 0x10
add esp, 8
sub ebx, 0x10
dec dword [ebp - 8]
jne 0x4b9fa0
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ebx, eax
je 0x4ba013
jbe 0x4ba005
mov ecx, dword [ebp + 8]
mov dl, byte [eax + ecx]
xor byte [edi + eax], dl
inc eax
cmp eax, ebx
jb 0x4b9ff7
lea eax, [esi + 0x60]
push eax
push edi
call dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp - 0xc]
shld eax, ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
bswap ecx
xor dword [esi + 0x4c], ecx
lea ecx, [esi + 0x60]
push ecx
bswap eax
xor dword [esi + 0x48], eax
push edi
call dword [ebp + 0xc]
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ebx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
mov dword [esi], edx
mov edx, dword [esi + 0x4c]
add esp, 8
mov dword [esi + 4], eax
bswap ebx
mov dword [esi + 0xc], edx
xor eax, eax
mov edx, dword [esi + 0x170]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x174]
mov dword [esi + 8], ecx
push eax
lea ecx, [esi + 0x20]
push ecx
push esi
call edx
add esp, 0xc
inc ebx
bswap ebx
pop edi
mov dword [esi + 0xc], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.005e38a0
mov ecx, dword [esi + 0x38]
or ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
je 0x4ba0c4
mov eax, 0xfffffffe
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x4ba170
jb 0x4ba0e3
test ecx, ecx
jne 0x4ba170
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x4ba11e
test ebx, ebx
je 0x4ba10d
mov eax, dword [ebp + 8]
mov cl, byte [eax]
xor byte [edi + esi + 0x40], cl
inc eax
inc edi
dec ebx
and edi, 0xf
mov dword [ebp + 8], eax
jne 0x4ba0f3
jmp 0x4ba111
test edi, edi
jne 0x4ba162
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call edx
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [ebp - 8], eax
je 0x4ba147
mov edx, dword [ebp + 8]
push eax
push edx
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add esp, 0x10
add ecx, eax
sub ebx, eax
jmp 0x4ba14a
mov ecx, dword [ebp + 8]
test ebx, ebx
je 0x4ba162
xor eax, eax
mov edi, ebx
test ebx, ebx
je 0x4ba162
mov dl, byte [eax + ecx]
xor byte [esi + eax + 0x40], dl
inc eax
cmp eax, ebx
jb 0x4ba156
mov dword [esi + 0x16c], edi
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.005e38a0
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [eax]
push edi
mov edi, ecx
test esi, esi
je 0x4bb460
mov edi, edi
test ebx, ebx
je 0x4bb460
mov dl, byte [esi + edi]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
inc eax
inc ecx
inc esi
dec ebx
and esi, 0xf
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ecx
jne 0x4bb440
cmp ebx, 0x10
jb 0x4bb4d8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, ecx
sub eax, edi
mov dword [ebp + 0x10], eax
mov eax, edx
sub eax, edi
mov dword [ebp - 4], eax
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ecx, eax
add edx, eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
mov edi, edi
mov eax, dword [ebp + 0x14]
push eax
push edi
push edi
call dword [ebp + 0x1c]
add esp, 0xc
cmp esi, 0x10
jae 0x4bb4c4
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
nop
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax]
xor edx, dword [eax]
mov esi, dword [ebp + 0x10]
mov dword [esi + eax], edx
add eax, 4
dec ecx
jne 0x4bb4b0
mov eax, 0x10
add dword [ebp + 0x10], eax
add dword [ebp - 4], eax
sub ebx, eax
xor esi, esi
dec dword [ebp - 8]
jne 0x4bb490
test ebx, ebx
je 0x4bb51b
mov eax, dword [ebp + 0x14]
push eax
push edi
push edi
call dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
sub edx, edi
add esp, 0xc
lea eax, [esi + edi]
sub ecx, edi
mov dword [ebp + 0x10], edx
add esi, ebx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor dl, byte [eax]
mov edi, dword [ebp + 0x10]
mov byte [eax + edi], dl
inc eax
dec ebx
jne 0x4bb500
mov eax, dword [ebp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x18]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.005e38a0
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov esi, ecx
test edi, edi
je 0x4bb5d0
mov edi, edi
test ebx, ebx
je 0x4bb5d0
mov dl, byte [edi + esi]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
inc eax
inc ecx
inc edi
dec ebx
and edi, 0xf
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ecx
jne 0x4bb5b0
cmp ebx, 0x10
jb 0x4bb648
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, ecx
sub eax, esi
mov dword [ebp + 0x10], eax
mov eax, edx
sub eax, esi
mov dword [ebp - 4], eax
mov eax, ebx
shr eax, 4
mov dword [ebp - 0xc], eax
shl eax, 4
add ecx, eax
xor edi, edi
add edx, eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push eax
push esi
push ecx
call dword [ebp + 0x20]
mov edx, dword [ebp + 0x18]
add esp, 0xc
call fcn.004bb560
mov eax, esi
mov dword [ebp - 8], 4
mov edx, dword [ebp - 4]
mov ecx, dword [edx + eax]
xor ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
add eax, 4
dec dword [ebp - 8]
jne 0x4bb620
mov eax, 0x10
add dword [ebp + 0x10], eax
add dword [ebp - 4], eax
sub ebx, eax
dec dword [ebp - 0xc]
jne 0x4bb600
test ebx, ebx
je 0x4bb690
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push eax
push esi
push ecx
call dword [ebp + 0x20]
mov edx, dword [ebp + 0x18]
add esp, 0xc
call fcn.004bb560
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
sub edx, esi
lea eax, [edi + esi]
sub ecx, esi
mov dword [ebp + 0x10], edx
add edi, ebx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
mov esi, dword [ebp + 0x10]
mov byte [eax + esi], dl
inc eax
dec ebx
jne 0x4bb675
mov eax, dword [ebp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c
call fcn.005e38a0
mov eax, dword [0x6c6e10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push ebx
movzx ebx, byte [edi + 5]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movzx edx, byte [edi + 1]
mov dword [ebp - 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [edi + 2]
push esi
mov esi, dword [eax]
lea eax, [edi + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [ebp - 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [ebp - 0xb], al
mov eax, ecx
mov ebx, ecx
mov byte [ebp - 0xc], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 0xa], al
mov byte [ebp - 9], cl
mov ecx, edx
mov eax, edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 8], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ebx
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x4bb9a7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea esp, [esp]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4bb92a
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.004bc120
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x20]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [ebp - 0xa], cl
mov ecx, eax
mov byte [ebp - 9], dl
mov edx, eax
mov byte [ebp - 8], al
shr ecx, 8
shr eax, 0x18
shr edx, 0x10
add esp, 8
inc dword [ebp - 0x1c]
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 5], al
mov eax, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 6], dl
mov dl, byte [ebp + esi - 0xc]
xor dl, byte [eax]
inc esi
mov byte [ecx + eax], dl
inc eax
and esi, 7
cmp dword [ebp - 0x14], 0
mov dword [ebp + 8], eax
jne 0x4bb8d0
cmp dword [ebp - 0x1c], 0
je 0x4bb992
mov eax, dword [ebp - 0x2c]
mov byte [edi], bl
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
mov ecx, dword [ebp - 0x20]
mov edx, ebx
shr edx, 0x10
mov byte [eax + 1], dl
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
mov dword [ecx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [edx], esi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
Function at 0x4bbb90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, edx
push edi
mov byte [esi], 0
cmp eax, 0x80
jle 0x4bbbac
mov eax, 0x80
test ecx, ecx
jle 0x4bbbb8
cmp ecx, 0x400
jle 0x4bbbc0
mov ecx, 0x400
mov dword [ebp + 0x10], ecx
push ebx
test eax, eax
jle 0x4bbbdc
mov edi, dword [ebp + 0xc]
sub edi, esi
mov ebx, eax
lea esp, [esp]
mov cl, byte [edi + edx]
mov byte [edx], cl
inc edx
dec ebx
jne 0x4bbbd0
mov ecx, dword [ebp + 0x10]
movzx edx, byte [esi + eax - 1]
cmp eax, 0x80
jge 0x4bbc0e
mov edi, esi
sub edi, eax
lea esp, [esp]
movzx ebx, byte [edi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x66b0c0]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x80
jl 0x4bbbf0
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea edi, [eax + esi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [edi]
and ebx, ecx
movzx ecx, byte [ebx + 0x66b0c0]
mov byte [edi], cl
test eax, eax
je 0x4bbc54
lea esp, [esp]
movzx ebx, byte [edi + edx - 1]
dec edi
xor ebx, ecx
dec eax
movzx ecx, byte [ebx + 0x66b0c0]
mov byte [edi], cl
jne 0x4bbc40
lea ecx, [esi + 0xfc]
lea eax, [esi + 0x7e]
mov edx, 0x40
pop ebx
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
dec edx
jne 0x4bbc63
pop edi
pop esi
pop ebp
ret
Function at 0x4bcb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.005e38a0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x14]
mov dword [ebp - 4], edi
cmp ebx, edi
jbe 0x4bcbca
mov eax, dword [esi + 0x18]
cmp ebx, eax
jb 0x4bcb7f
mov edx, dword [esi + 0x40]
mov ecx, ebx
sub ecx, eax
add ecx, 4
and ecx, 0xfffffffc
add eax, ecx
push 0x71
mov dword [esi + 0x18], eax
push str.....cryptomodesocb128.c
shl eax, 4
push eax
push edx
call fcn.00413d50
add esp, 0x10
test eax, eax
jne 0x4bcb7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], eax
cmp edi, ebx
jae 0x4bcbc7
mov eax, dword [ebp - 4]
sub ebx, eax
shl edi, 4
add eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x40]
mov bl, byte [edi + eax]
lea ecx, [edi + eax]
shr bl, 7
lea esi, [ecx + 0x10]
neg bl
push 1
mov edx, esi
and bl, 0x87
call fcn.004bca20
xor byte [esi + 0xf], bl
mov esi, dword [ebp + 8]
add esp, 4
add edi, 0x10
dec dword [ebp - 8]
jne 0x4bcb93
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov dword [esi + 0x14], edi
mov eax, ebx
shl eax, 4
add eax, dword [esi + 0x40]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdf00
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004bd9d0
add esp, 4
test eax, eax
js 0x4be147
mov edx, dword [edi + 0xf0]
add edx, edx
push ebx
push esi
add edx, edx
xor esi, esi
test edx, edx
jle 0x4bdf70
lea ecx, [edi + edx*4 + 8]
lea eax, [edi + 8]
mov ebx, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebx
mov ebx, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebx
mov ebx, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebx
mov ebx, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4bdf31
mov edi, dword [ebp + 8]
mov edx, 1
cmp dword [edi + 0xf0], edx
jle 0x4be143
lea eax, [edi + 2]
jmp 0x4bdf90
mov ecx, dword [eax + 0xe]
movzx ebx, byte [eax + 0xf]
mov ebx, dword [ebx*4 + 0x669370]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x669370]
and esi, 0xff
mov esi, dword [esi*4 + 0x669f70]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a770]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x669370]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x66ab70]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x669370]
movzx ebx, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x66a370]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov ebx, dword [ebx*4 + 0x669370]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x669370]
and esi, 0xff
mov esi, dword [esi*4 + 0x669f70]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a770]
movzx ebx, byte [eax + 4]
mov ebx, dword [ebx*4 + 0x669370]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a370]
movzx ebx, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x669370]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x66ab70]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov ebx, dword [ebx*4 + 0x669370]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x669370]
and esi, 0xff
mov esi, dword [esi*4 + 0x669f70]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a770]
movzx ebx, byte [eax + 8]
mov ebx, dword [ebx*4 + 0x669370]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a370]
movzx ebx, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x669370]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x66ab70]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov ebx, dword [ebx*4 + 0x669370]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x669370]
and esi, 0xff
mov esi, dword [esi*4 + 0x669f70]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a770]
movzx ebx, byte [eax + 0xc]
mov ebx, dword [ebx*4 + 0x669370]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x669370]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x66a370]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x66ab70]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [edi + 0xf0]
jl 0x4bdf90
pop esi
xor eax, eax
pop ebx
pop edi
pop ebp
ret
Function at 0x4bf0f0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.005e38a0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1048
push 0x667f28
push ebx
mov edi, ecx
mov esi, edx
call fcn.005e12d0
add esp, 0xc
cmp esi, 0x48
jle 0x4bf124
mov esi, 0x48
lea ecx, [esi + edi]
mov eax, edi
lea esi, [ebx + 8]
mov dword [ebp - 4], 6
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4bf13d
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf14c
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf15b
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf16a
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4bf177
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf186
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf195
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf1a4
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4bf1b1
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf1c0
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf1cf
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x4bf1de
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [ebp - 4]
jne 0x4bf133
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
xor esi, esi
lea esp, [esp]
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0059d6c0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4bf200
xor esi, esi
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0059d6c0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x4bf224
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30
call fcn.005e38a0
mov eax, dword [0x6c6e10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
inc eax
push ebx
movzx ebx, byte [eax + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
push esi
mov esi, dword [ecx]
movzx ecx, byte [eax - 1]
push edi
mov edi, edx
movzx edx, byte [eax]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
test edi, edi
je 0x4bf5d6
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
sub ebx, edi
lea ebx, [ebx]
dec dword [ebp - 0x14]
test esi, esi
jne 0x4bf556
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0059d6c0
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov byte [ebp - 0xb], dl
mov edx, dword [ebp - 0x1c]
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [ebp - 0x18]
mov byte [ebp - 9], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
xor al, byte [edi]
inc esi
mov byte [ebx + edi], al
inc edi
and esi, 7
cmp dword [ebp - 0x14], 0
jne 0x4bf500
cmp dword [ebp - 0x18], 0
je 0x4bf5c0
mov edi, dword [ebp - 0x30]
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [ebp - 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret