joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497440
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [edx + 4]
mov ebp, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, eax
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov edx, dword [edx + 0xc]
mov esi, eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
bswap eax
mov dword [esp + 0x18], 0
mov edi, edi
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + 0x4f42c8]
xor ebp, edx
mov edi, esi
xor edi, ebp
mov edx, edi
ror edx, 8
mov ebx, edi
rol ebx, 8
xor edx, ebx
xor edi, edx
xor ecx, edi
xor eax, edi
mov edi, eax
xor edi, ecx
mov edx, edi
ror edx, 8
mov ebx, edi
rol ebx, 8
xor edx, ebx
xor edi, edx
mov ebx, edi
xor ebx, esi
rol ebx, 5
mov edx, eax
rol edx, 2
mov eax, ecx
mov ecx, edx
rol eax, 1
mov esi, ebx
not esi
not ecx
and ecx, esi
xor eax, ecx
mov ecx, edx
mov edx, ebx
and edx, eax
xor edx, edi
xor edx, ebp
mov esi, ecx
xor esi, edx
xor esi, ebx
xor esi, eax
mov edi, edx
mov ebx, esi
not edi
not ebx
and edi, ebx
xor eax, edi
mov ebp, esi
and ebp, eax
xor ebp, ecx
ror eax, 1
ror esi, 5
ror edx, 2
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x18]
inc edx
mov dword [esp + 0x18], edx
cmp edx, 0x10
jne 0x497490
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 0x24]
xor ebp, 0xd4
mov dword [edi], ebp
mov edi, dword [edx + 0x24]
mov dword [edi + 4], ecx
mov edi, dword [edx + 0x24]
mov dword [edi + 8], esi
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov edx, esi
xor edx, ebp
mov edi, edx
ror edi, 8
mov ebx, edx
rol ebx, 8
xor edi, ebx
xor edx, edi
xor ecx, edx
xor eax, edx
mov edx, eax
xor edx, ecx
mov edi, edx
ror edi, 8
mov ebx, edx
rol ebx, 8
xor edi, ebx
xor edx, edi
mov edi, dword [esp + 0x10]
mov ebx, edx
xor ebx, ebp
mov ebp, dword [edi + 0x14]
mov dword [ebp], ebx
mov ebx, dword [edi + 0x14]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 0x14]
xor edx, esi
mov dword [ecx + 8], edx
mov edx, dword [edi + 0x14]
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 8
Function at 0x4975e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx edx, word [eax]
push ebx
mov ebx, dword [ecx + 0x14]
push ebp
push esi
movzx esi, word [eax + 4]
push edi
movzx edi, word [eax + 2]
mov dword [esp + 0x18], edx
movzx edx, word [eax + 6]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0
mov bp, dx
mov cx, si
nop
mov eax, edx
not eax
and eax, edi
mov edi, edx
and edi, esi
add eax, edi
add ax, word [ebx]
add ax, word [esp + 0x18]
rol ax, 1
movzx eax, ax
mov edi, eax
not edi
and edi, esi
mov esi, edx
and esi, eax
add edi, esi
add di, word [ebx + 2]
mov dword [esp + 0x18], eax
add di, word [esp + 0x14]
rol di, 2
movzx edi, di
mov esi, edi
not esi
and esi, edx
mov edx, edi
and edx, eax
add esi, edx
add si, word [ebx + 4]
mov dword [esp + 0x14], edi
add si, cx
rol si, 3
movzx esi, si
mov ecx, esi
not ecx
and ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, esi
and edx, edi
add ecx, edx
add cx, word [ebx + 6]
mov dword [esp + 0x10], esi
add cx, bp
rol cx, 5
movzx edx, cx
mov dword [esp + 0x28], edx
cmp eax, 4
je 0x4976ac
cmp eax, 0xa
jne 0x49773f
mov bp, word [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
movzx edx, bp
and edx, 0x8000003f
jns 0x4976c8
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x18]
add cx, word [eax + edx*2]
movzx edx, cx
and edx, 0x8000003f
mov word [esp + 0x18], cx
jns 0x4976e6
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x14]
add cx, word [eax + edx*2]
mov word [esp + 0x14], cx
movzx ecx, cx
mov edx, ecx
and edx, 0x8000003f
jns 0x497706
dec edx
or edx, 0xffffffc0
inc edx
mov cx, word [esp + 0x10]
add cx, word [eax + edx*2]
movzx edx, cx
and edx, 0x8000003f
mov word [esp + 0x10], cx
jns 0x497724
dec edx
or edx, 0xffffffc0
inc edx
add bp, word [eax + edx*2]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov word [esp + 0x28], bp
mov edx, dword [esp + 0x28]
jmp 0x497749
mov bp, word [esp + 0x28]
mov cx, word [esp + 0x10]
inc eax
add ebx, 8
mov dword [esp + 0x1c], eax
cmp eax, 0x10
jne 0x497620
mov eax, dword [esp + 0x2c]
movzx edx, word [esp + 0x18]
pop edi
mov word [eax], dx
movzx edx, word [esp + 0x10]
pop esi
mov word [eax + 6], bp
pop ebp
mov word [eax + 2], dx
mov word [eax + 4], cx
pop ebx
add esp, 0x14
ret 8
Function at 0x497790
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
push ebx
movzx ebx, word [eax + 4]
push ebp
movzx ebp, word [eax + 2]
movzx eax, word [eax + 6]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], ecx
lea ecx, [eax + 0x78]
push esi
add eax, 0x7c
mov dword [esp + 0x2c], edx
push edi
mov di, word [esp + 0x30]
mov dword [esp + 0x1c], eax
mov ax, word [esp + 0x18]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], ecx
mov dx, bx
mov si, bp
mov ecx, ebx
and ebx, ebp
ror ax, 5
not ecx
and ecx, dword [esp + 0x30]
sub ax, cx
mov ecx, dword [esp + 0x1c]
sub ax, bx
sub ax, word [ecx + 2]
ror dx, 3
movzx eax, ax
mov ebx, ebp
not ebx
and ebx, eax
sub dx, bx
mov ebx, ebp
mov ebp, dword [esp + 0x30]
and ebx, ebp
sub dx, bx
sub dx, word [ecx]
ror si, 2
movzx ebx, dx
mov edx, ebp
not edx
and edx, ebx
sub si, dx
mov edx, eax
and edx, ebp
sub si, dx
sub si, word [ecx - 2]
mov edx, dword [esp + 0x20]
mov ecx, eax
movzx ebp, si
ror di, 1
not ecx
and ecx, ebp
sub di, cx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
and eax, ebx
sub di, ax
sub di, word [edx]
mov dword [esp + 0x10], ebx
movzx eax, di
mov dword [esp + 0x14], ebp
mov dword [esp + 0x30], eax
cmp ecx, 4
je 0x49787c
cmp ecx, 0xa
jne 0x497902
mov edx, dword [esp + 0x28]
mov ebx, dword [edx + 0x14]
mov dx, word [esp + 0x10]
movzx eax, dx
mov esi, eax
and esi, 0x8000003f
jns 0x49789a
dec esi
or esi, 0xffffffc0
inc esi
mov ax, word [esp + 0x18]
sub ax, word [ebx + esi*2]
mov si, word [esp + 0x14]
movzx edi, si
and edi, 0x8000003f
jns 0x4978b8
dec edi
or edi, 0xffffffc0
inc edi
sub dx, word [ebx + edi*2]
mov di, word [esp + 0x30]
movzx ebp, di
and ebp, 0x8000003f
mov word [esp + 0x10], dx
jns 0x4978d6
dec ebp
or ebp, 0xffffffc0
inc ebp
sub si, word [ebx + ebp*2]
movzx ebp, ax
and ebp, 0x8000003f
mov word [esp + 0x14], si
jns 0x4978ef
dec ebp
or ebp, 0xffffffc0
inc ebp
sub di, word [ebx + ebp*2]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov word [esp + 0x30], di
jmp 0x497916
mov ax, word [esp + 0x18]
mov dx, word [esp + 0x10]
mov si, word [esp + 0x14]
mov di, word [esp + 0x30]
sub dword [esp + 0x1c], 8
sub dword [esp + 0x20], 8
inc ecx
mov dword [esp + 0x24], ecx
cmp ecx, 0x10
jne 0x4977e7
mov ecx, dword [esp + 0x34]
mov word [ecx], di
pop edi
mov word [ecx + 2], si
pop esi
pop ebp
mov word [ecx + 4], dx
mov word [ecx + 6], ax
pop ebx
add esp, 0x1c
ret 8
Function at 0x497a00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00497950
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp esi, eax
ja 0x497a1f
mov eax, esi
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
call fcn.00459280
add esp, 0xc
mov eax, esi
cmp esi, 0x80
je 0x497a74
lea esp, [esp]
mov ecx, dword [esp + 0xc]
movzx ebx, byte [ecx + eax - 1]
mov edx, ecx
sub edx, esi
movzx edx, byte [edx + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x497a63
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + 0x4f42e0]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x80
jne 0x497a40
mov eax, dword [esp + 0xc]
sub eax, esi
movzx ecx, byte [eax + 0x80]
mov dl, byte [ecx + 0x4f42e0]
mov ecx, 0x7f
sub ecx, esi
mov byte [eax + 0x80], dl
js 0x497abc
jmp 0x497aa0
mov eax, dword [esp + 0xc]
movzx ebx, byte [eax + ecx + 1]
add eax, ecx
movzx edx, byte [eax + esi]
xor edx, ebx
dec ecx
mov dl, byte [edx + 0x4f42e0]
mov byte [eax], dl
jns 0x497aa0
xor eax, eax
mov edi, edi
mov edx, dword [esp + 0xc]
mov dx, word [eax + edx]
mov ecx, dword [edi + 0x14]
mov word [eax + ecx], dx
add eax, 2
cmp eax, 0x80
jne 0x497ac0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esp + 0x10]
push edx
call eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x497b80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x14]
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov edx, dword [edi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
add eax, dword [esi]
mov esi, dword [esi + 4]
add esi, dword [edi + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
add edi, 0xc
mov dword [esp + 0x14], 5
jmp 0x497bc0
lea ebp, [eax + eax + 1]
imul ebp, eax
lea eax, [esi + esi + 1]
imul eax, esi
rol ebp, 5
rol eax, 5
mov ecx, eax
and ecx, 0x1f
xor eax, edx
mov ebx, ebp
xor ebx, dword [esp + 0x20]
add edi, 0x20
rol ebx, cl
mov ecx, ebp
and ecx, 0x1f
add ebx, dword [edi - 0x24]
rol eax, cl
lea edx, [ebx + ebx + 1]
imul edx, ebx
add eax, dword [edi - 0x20]
mov ecx, eax
lea eax, [ecx + ecx + 1]
imul eax, ecx
rol eax, 5
rol edx, 5
mov dword [esp + 0x20], ecx
mov ebp, eax
xor ebp, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x1f
rol ebp, cl
xor edx, esi
mov ecx, eax
and ecx, 0x1f
add ebp, dword [edi - 0x1c]
rol edx, cl
lea esi, [ebp + ebp + 1]
imul esi, ebp
add edx, dword [edi - 0x18]
lea eax, [edx + edx + 1]
imul eax, edx
rol eax, 5
rol esi, 5
mov dword [esp + 0x10], edx
mov ecx, esi
and ecx, 0x1f
mov edx, eax
xor edx, dword [esp + 0x20]
xor esi, ebx
rol edx, cl
mov ecx, eax
and ecx, 0x1f
add edx, dword [edi - 0x14]
rol esi, cl
lea eax, [edx + edx + 1]
imul eax, edx
add esi, dword [edi - 0x10]
lea ebx, [esi + esi + 1]
imul ebx, esi
rol ebx, 5
rol eax, 5
mov dword [esp + 0x20], esi
mov ecx, eax
and ecx, 0x1f
mov esi, ebx
xor esi, dword [esp + 0x10]
xor eax, ebp
rol esi, cl
mov ecx, ebx
and ecx, 0x1f
add esi, dword [edi - 0xc]
rol eax, cl
add eax, dword [edi - 8]
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x497bc0
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x14]
mov edi, dword [ecx + 0xa8]
add edx, dword [ecx + 0xac]
mov ecx, dword [esp + 0x24]
add edi, dword [esp + 0x20]
mov dword [ecx + 0xc], esi
mov dword [ecx], edi
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
pop ebx
add esp, 0xc
ret 8
Function at 0x497cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
push ebx
mov ebx, dword [ecx + 0x14]
push ebp
push esi
mov esi, dword [edx + 0xc]
push edi
mov edi, dword [edx + 8]
sub edi, dword [ebx + 0xac]
mov dword [esp + 0x10], esi
mov esi, dword [edx]
sub esi, dword [ebx + 0xa8]
mov ebp, ebx
mov dword [esp + 0x20], ecx
lea ecx, [ebp + 0x98]
add ebp, 0x9c
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 5
nop
sub eax, dword [ebp + 8]
lea ebx, [esi + esi + 1]
imul ebx, esi
rol ebx, 5
lea edx, [edi + edi + 1]
imul edx, edi
mov edi, dword [esp + 0x28]
rol edx, 5
mov ecx, ebx
and ecx, 0x1f
ror eax, cl
sub esi, dword [ebp]
mov ecx, edx
and ecx, 0x1f
xor eax, edx
mov edx, dword [esp + 0x10]
sub edx, dword [edi + 8]
mov ebp, dword [esp + 0x28]
ror edx, cl
lea edi, [eax + eax + 1]
imul edi, eax
xor edx, ebx
lea ebx, [edx + edx + 1]
imul ebx, edx
rol ebx, 5
rol edi, 5
mov ecx, ebx
and ecx, 0x1f
ror esi, cl
mov ecx, edi
and ecx, 0x1f
xor esi, edi
mov edi, dword [esp + 0x14]
sub edi, dword [ebp]
mov ebp, dword [esp + 0x18]
ror edi, cl
sub edx, dword [ebp - 8]
lea ecx, [esi + esi + 1]
imul ecx, esi
xor edi, ebx
lea ebx, [edi + edi + 1]
imul ebx, edi
rol ebx, 5
rol ecx, 5
mov dword [esp + 0x14], ecx
mov ecx, ebx
and ecx, 0x1f
ror edx, cl
mov ecx, dword [esp + 0x14]
sub edi, dword [ebp - 0x10]
sub ebp, 0x20
xor edx, ecx
and ecx, 0x1f
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x28]
sub eax, dword [edx - 8]
mov dword [esp + 0x18], ebp
ror eax, cl
mov ecx, dword [esp + 0x10]
xor eax, ebx
lea edx, [eax + eax + 1]
imul edx, eax
lea ebx, [ecx + ecx + 1]
imul ebx, ecx
rol edx, 5
rol ebx, 5
mov ecx, edx
and ecx, 0x1f
ror edi, cl
mov ecx, ebx
and ecx, 0x1f
xor edi, ebx
mov ebx, dword [esp + 0x28]
sub esi, dword [ebx - 0x10]
sub ebx, 0x20
ror esi, cl
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebx
xor esi, edx
dec dword [esp + 0x1c]
jne 0x497d20
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov edx, dword [esp + 0x10]
sub edx, dword [ecx + 4]
sub eax, dword [ecx]
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 8], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], edx
pop ebx
add esp, 0x14
ret 8
Function at 0x497e50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edi, eax
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [edx + 0xc]
mov ebp, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
bswap eax
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 8
mov edx, dword [esi + 4]
xor edx, dword [esp + 0x20]
xor edx, ebp
mov ecx, edx
mov eax, edx
shr ecx, 0x10
shr eax, 0x18
movzx ebx, cl
mov ecx, dword [eax*4 + str.880_b_]
xor ecx, dword [ebx*4 + 0x500340]
mov eax, edx
shr eax, 8
movzx edx, dl
movzx eax, al
xor ecx, dword [eax*4 + str.0_b88]
mov eax, dword [esi]
xor ecx, dword [edx*4 + 0x4ffb40]
xor eax, ebp
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + str.880_b_]
xor edx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor edx, dword [eax*4 + 0x4ffb40]
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
xor ecx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + str.0_b88]
mov ebx, dword [esp + 0x10]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
mov eax, dword [esi + 0xc]
xor ebx, ecx
add ecx, edx
xor eax, ebx
xor edi, ecx
xor eax, edi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
xor ecx, dword [edx*4 + 0x500340]
mov edx, eax
shr edx, 8
movzx edx, dl
xor ecx, dword [edx*4 + str.0_b88]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], ebx
xor eax, edi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + str.880_b_]
xor edx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor edx, dword [eax*4 + 0x4ffb40]
add esi, 0x10
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
xor dword [esp + 0x20], ecx
add ecx, edx
xor ebp, ecx
dec dword [esp + 0x14]
jne 0x497ea5
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x14]
bswap eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0xc
ret 8
Function at 0x498060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov esi, eax
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x14], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [edx + 0xc]
mov edi, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
bswap eax
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0x70]
mov dword [esp + 0x20], eax
add ebp, 0x74
mov dword [esp + 0x18], 8
nop
mov edx, dword [ebp + 8]
xor edx, dword [esp + 0x10]
xor edx, edi
mov eax, edx
mov ecx, edx
shr eax, 0x10
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
movzx eax, al
xor ecx, dword [eax*4 + 0x500340]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + str.0_b88]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 8]
movzx edx, dl
xor ecx, dword [edx*4 + 0x4ffb40]
xor eax, edi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + str.880_b_]
xor edx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor edx, dword [eax*4 + 0x4ffb40]
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + str.0_b88]
mov ebx, dword [esp + 0x14]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
mov eax, dword [ebp]
xor ebx, ecx
add ecx, edx
xor eax, ebx
xor esi, ecx
xor eax, esi
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
xor ecx, dword [edx*4 + 0x500340]
mov edx, eax
shr edx, 8
movzx edx, dl
xor ecx, dword [edx*4 + str.0_b88]
mov edx, dword [esp + 0x20]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
mov eax, dword [edx]
mov dword [esp + 0x14], ebx
xor eax, esi
add eax, ecx
mov ebx, eax
shr ebx, 0x10
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + str.880_b_]
movzx ebx, bl
xor edx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor edx, dword [eax*4 + 0x4ffb40]
sub dword [esp + 0x20], 0x10
lea eax, [ecx + edx]
mov ebx, eax
shr ebx, 0x10
mov ecx, eax
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.880_b_]
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x500340]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + str.0_b88]
movzx eax, al
xor ecx, dword [eax*4 + 0x4ffb40]
sub ebp, 0x10
xor dword [esp + 0x10], ecx
add ecx, edx
xor edi, ecx
dec dword [esp + 0x18]
jne 0x4980c0
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x20]
bswap eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0xc
ret 8
Function at 0x49bc50
Capabilities:
Encode data using xor
Encrypt data using skipjack

Disassembly:
push ebx
push esi
lea esi, [ecx + 0x14]
mov ecx, dword [esp + 0xc]
push edi
add ecx, 9
mov edi, 0xa
xor eax, eax
movzx edx, byte [ecx]
mov ebx, dword [esi]
xor edx, eax
mov dl, byte [edx + 0x4f4400]
mov byte [eax + ebx], dl
inc eax
cmp eax, 0x100
jne 0x49bc64
dec ecx
add esi, 0x10
dec edi
jne 0x49bc62
pop edi
pop esi
pop ebx
ret 8
Function at 0x49cd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffffffffff
push 0x4dd258
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
push 1
mov dword [esp + 0x54], ebx
call fcn.00479b90
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
add esp, 4
push ebx
push ebx
mov ecx, esi
mov dword [esp + 0x4c], esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
mov edi, 4
push edi
mov ecx, esi
call edx
mov ebp, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x50], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
push 1
mov byte [esp + 0x54], 2
call fcn.00479b90
mov edi, eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
add esp, 4
push ebx
push ebx
mov ecx, edi
mov dword [esp + 0x3c], edi
call edx
mov eax, dword [edi]
mov edx, dword [eax]
push 4
mov ecx, edi
call edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [edx + eax*4]
mov ecx, 4
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x50], 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
bswap eax
mov edx, dword [esp + 0x28]
mov dword [ebp], eax
mov eax, 0x4f4500
sub eax, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x49ce85
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
xor ebp, ebp
add eax, ecx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x38]
mov cl, byte [edx + ebp]
mov eax, dword [esp + 0x18]
mov al, byte [eax]
cmp cl, bl
je 0x49ced0
cmp al, bl
je 0x49ced0
movzx edx, al
movzx eax, byte [edx + 0x500d40]
movzx ecx, cl
movzx edx, byte [ecx + 0x500d40]
add eax, edx
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [esp + 0x14]
mov dl, byte [edx + 0x500e40]
xor byte [eax], dl
add dword [esp + 0x18], 4
inc ebp
cmp ebp, 4
jne 0x49ce91
mov eax, 1
add dword [esp + 0x14], eax
sub dword [esp + 0x20], eax
jne 0x49ce81
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
bswap eax
mov edx, dword [esp + 0x58]
mov ebp, dword [esp + 0x1c]
mov dword [edx + ebp*4], eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
push 4
push ecx
mov ecx, edi
call edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, dword [eax + 4]
push 4
push ecx
mov ecx, esi
mov dword [esp + 0x58], 0xffffffff
call edx
inc ebp
mov dword [esp + 0x1c], ebp
cmp ebp, 4
jne 0x49cdad
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret