joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4750d0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x562308
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x1c
push str.boost::filesystem::copy_file
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00402c6c
mov edx, dword [esp + 0x3c]
mov ecx, 8
mov dword [esp + 0x30], 0
cmp dword [edx + 0x18], ecx
jb 0x475135
mov esi, dword [edx + 4]
jmp 0x475138
lea esi, [edx + 4]
mov eax, dword [esp + 0x38]
cmp dword [eax + 0x18], ecx
jb 0x475146
mov ecx, dword [eax + 4]
jmp 0x475149
lea ecx, [eax + 4]
lea edi, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
push edi
push edx
push eax
xor eax, eax
cmp dword [esp + 0x50], eax
sete al
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.00474c90
add esp, 0x14
cmp dword [esp + 0x24], 0x10
jb 0x47518c
mov eax, dword [esp + 0x10]
push eax
call fcn.005295c1
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x475420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5623a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x475457
mov eax, dword [esi]
jmp 0x475459
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47548f
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push eax
push edi
push esi
call fcn.00474f10
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
test ebx, 0x400
je 0x47558e
cmp dword [edi + 0x18], 8
jb 0x4754a9
mov ecx, dword [esi]
mov dword [esp + 0x40], ecx
jmp 0x4754ad
mov dword [esp + 0x40], esi
push 0
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x18]
call fcn.00473470
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 0
jae 0x4754d4
lea eax, [esp + 0x14]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x40], esi
cmp dword [esp + 0x28], 8
mov byte [esp + 0x34], 2
jb 0x475509
mov eax, dword [esp + 0x14]
push eax
call fcn.005295c1
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp esi, 0xffffffff
jne 0x47554d
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push edx
push edi
push esi
call fcn.00474f10
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push edi
call fcn.00473ca0
add esp, 4
mov dword [esp + 0x34], 0xffffffff
push esi
test al, al
jne 0x475588
mov edi, dword [esp + 0x40]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4755a4
mov dword [esi], 0
call fcn.0048fb30
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 3
test bl, 0x10
jne 0x4755bd
mov dword [esp + 0x40], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x3c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4755e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x18], 8
jb 0x4755f2
mov eax, dword [edi + 4]
jmp 0x4755f5
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47561c
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push eax
push edi
push esi
call fcn.00474f10
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x18]
test esi, esi
je 0x475632
mov dword [esi], 0
call fcn.0048fb30
mov dword [esi + 4], eax
test ebx, 0x400
je 0x475667
push edi
call fcn.00473ca0
add esp, 4
test al, al
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
jne 0x47565b
mov dword [esp + 0x14], 9
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 3
test bl, 0x10
jne 0x475680
mov dword [esp + 0x14], 2
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], edx
pop ebx
ret

Function at 0x475a10
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x562428
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x9c]
cmp dword [esi + 0x18], 8
jb 0x475a4b
mov eax, dword [esi + 4]
jmp 0x475a4e
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x475a7b
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x475a74
mov dword [esi], 0
call fcn.0048fb30
mov dword [esi + 4], eax
mov al, 1
jmp 0x475b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.0048fb30
cmp ebx, 0xb7
jne 0x475ac3
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00475420
add esp, 0xc
cmp dword [eax], 3
jne 0x475ac3
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x475b12
mov dword [esi], 0
call fcn.0048fb30
mov dword [esi + 4], eax
jmp 0x475b12
mov edi, dword [esp + 0xa0]
test edi, edi
jne 0x475b08
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x20]
call fcn.0040229b
mov dword [esp + 0x94], edi
call fcn.0048fb30
push eax
push ebx
push esi
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x48]
call fcn.004749b0
push 0x5ac670
lea eax, [esp + 0x3c]
push eax
call fcn.0052b066
call fcn.0048fb30
mov dword [edi], ebx
mov dword [edi + 4], eax
xor al, al
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4762e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x562568
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c4954]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00473e00
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.0043a729
cmp dword [esp + 0x24], 8
jb 0x47637c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005295c1
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0052b498
add esp, 0x30
ret 0x1c

Function at 0x477050
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x47707f
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x477060
pop edi
pop esi
ret

Function at 0x47bc10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5627d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401254
mov dword [esp + 0x18], 0
test edi, edi
je 0x47bc54
add edi, 0x28
jmp 0x47bc56
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x47bc6e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x47c560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x562278
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011ff
mov dword [esp + 0x18], 0
test edi, edi
je 0x47c5a4
add edi, 0x28
jmp 0x47c5a6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x47c5be
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x47dac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x562aa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401254
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x47db0a
add edi, 0x28
jmp 0x47db0c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x47db24
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], 0x578ee8
mov dword [esi + 0x28], 0x578ee4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x484690
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5630d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0047ffb0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0047ffb0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.0047ffb0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48e120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5639c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011ff
mov dword [esi], 0x579bc4
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x48e185
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], 0x579bb0
mov dword [esi + 0x30], 0x579bac
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x48e220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x563a03
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c4954]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0048e120
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], 0x579bbc
mov dword [eax], 0x579bb8
mov dword [esi + 0x44], 0x579bcc
cmp edi, ecx
je 0x48e282
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00479f40
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x48f6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x591838
mov dword [esp], eax
mov dword [esp + 4], 0x574d58
mov dword [esp + 8], 0x574d68
mov dword [esp + 0xc], 0x57a018
mov dword [esp + 0x10], 0x57a014
mov dword [esp + 0x14], 0x5741b0
mov dword [esp + 0x18], 0x574030
mov dword [esp + 0x1c], 0x57a010
mov dword [esp + 0x20], 0x5776f0
mov dword [esp + 0x24], 0x591d48
mov dword [esp + 0x28], 0x591d50
mov dword [esp + 0x2c], 0x571f10
mov dword [esp + 0x30], 0x5720f4
mov dword [esp + 0x34], 0x57a00c
mov dword [esp + 0x38], 0x573e1c
mov dword [esp + 0x3c], 0x591d54
mov dword [esp + 0x40], 0x591d60
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x579d14
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x579ffc
mov dword [esp + 0x54], 0x579ff8
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x579ff4
mov dword [esp + 0x64], 0x579ff0
mov dword [esp + 0x68], 0x591acc
mov dword [esp + 0x6c], 0x591d4c
mov dword [esp + 0x70], 0x579d18
mov dword [esp + 0x74], 0x577708
mov dword [esp + 0x78], 0x5741a8
mov dword [esp + 0x7c], 0x573410
mov dword [esp + 0x80], 0x579ce8
mov dword [esp + 0x84], 0x579ce0
mov dword [esp + 0x88], 0x579cd8
mov dword [esp + 0x8c], 0x576204
mov dword [esp + 0x90], 0x591d5c
mov dword [esp + 0x94], 0x5737c8
mov dword [esp + 0x98], 0x591d8c
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x591d88
mov dword [esp + 0xc0], 0x579d9c
mov dword [esp + 0xc4], 0x579d84
mov dword [esp + 0xc8], 0x578198
mov dword [esp + 0xcc], str.ZYXWVUTRQPOLKJIHGFA
mov dword [esp + 0xd0], 0x579dbc
mov dword [esp + 0xd4], 0x579fec
mov dword [esp + 0xd8], 0x579cf0
mov dword [esp + 0xdc], 0x579da0
mov dword [esp + 0xe0], 0x5741ac
mov dword [esp + 0xe4], 0x579fe8
mov dword [esp + 0xe8], 0x579dac
mov dword [esp + 0xec], 0x579d98
cmp cl, 0x3c
jae 0x48f8dd
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x492980
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret

Function at 0x4929c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov cl, byte [esi]
test cl, cl
je 0x492a24
lea ecx, [ecx]
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [edi + eax*4]
inc esi
mov dword [edx + 8], ecx
mov cl, byte [esi]
test cl, cl
jne 0x4929e0
pop esi
ret
Function at 0x4946e0
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x5c0430
push ebx
call fcn.0052c940
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x49470a
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
nop
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x49472a
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494739
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494748
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494757
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x494764
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494773
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494782
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x494791
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x49479e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4947ad
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4947bc
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4947cb
mov eax, edi
xor dword [esi], edx
add esi, 0xc
sub dword [esp + 0x1c], 1
jne 0x494720
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004985b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4947e8
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call fcn.004985b0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x494810
pop esi
pop ebx
add esp, 8
ret
Function at 0x4968f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x496980
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.0052c940
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x49694f
sub eax, ebp
jmp 0x496951
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x496940
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x496970
sub eax, ebp
jmp 0x496972
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x496961
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x496aac
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x4969a8
mov ebx, edx
test ebx, ebx
je 0x4969f6
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x4969cb
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00498fe0
jmp 0x4969dd
cmp ecx, 2
jne 0x4969e4
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.00494b30
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.0052c940
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x496a20
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x496a34
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x496900
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x496aac
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x496a7b
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x496a5b
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.0052b710
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x496aac
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x496a95
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.0052b710
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4985b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor ecx, dword [eax]
mov esi, 1
jmp 0x4985d0
mov ebx, ecx
shr ebx, 0xe
and ebx, 0x3fc
mov ebx, dword [ebx + eax + 0x448]
mov ebp, ecx
shr ebp, 0x16
and ebp, 0x3fc
add ebx, dword [eax + ebp + 0x48]
mov ebp, ecx
shr ebp, 6
and ebp, 0x3fc
xor ebx, dword [eax + ebp + 0x848]
mov ebp, ecx
and ebp, 0xff
add ebx, dword [eax + ebp*4 + 0xc48]
add esi, 2
xor ebx, dword [eax + esi*4 - 8]
xor edx, ebx
mov ebx, edx
shr ebx, 0xe
and ebx, 0x3fc
mov ebx, dword [ebx + eax + 0x448]
mov ebp, edx
shr ebp, 0x16
and ebp, 0x3fc
add ebx, dword [eax + ebp + 0x48]
mov ebp, edx
shr ebp, 6
and ebp, 0x3fc
xor ebx, dword [eax + ebp + 0x848]
mov ebp, edx
and ebp, 0xff
add ebx, dword [eax + ebp*4 + 0xc48]
xor ebx, dword [eax + esi*4 - 4]
xor ecx, ebx
cmp esi, 0x10
jl 0x4985d0
xor edx, dword [eax + 0x44]
mov dword [edi + 4], ecx
mov dword [edi], edx
pop edi
pop esi
pop ebp
pop ebx
ret