joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441280
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a769
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5903c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4412d1
mov eax, dword [esi]
jmp 0x4412d3
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x2c], 8
jb 0x4412f0
mov eax, dword [esi + 0x18]
jmp 0x4412f3
lea eax, [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ecx
cmp dword [esi + 0x44], 8
jb 0x44130d
mov eax, dword [esi + 0x30]
jmp 0x441310
lea eax, [esi + 0x30]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x44132a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x60]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x441344
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x78]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x44135e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x90]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x44137b
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xa8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x441398
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4413b5
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push 0xc
push str.PC_BASE_INFO
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.00411010
push 0xb
push str.InstallTime
lea ecx, [esi + 0x60]
call fcn.00411010
push 4
push str.PCID
lea ecx, [esi + 0x18]
call fcn.00411010
push 5
push str.PCUID
lea ecx, [esi + 0x30]
call fcn.00411010
push 3
push 0x577c98
lea ecx, [esi + 0x48]
call fcn.00411010
push 4
push str.exce
lea ecx, [esi + 0x78]
call fcn.00411010
push 0xb
push str.LastRunDate
lea ecx, [esi + 0x90]
call fcn.00411010
push 0xf
push str.SoftwareVersion
lea ecx, [esi + 0xa8]
call fcn.00411010
push 0xb
push str.DataVersion
lea ecx, [esi + 0xc0]
call fcn.00411010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448240
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x44826d
nop dword [eax]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x571ff0]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x448250
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4482f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [edx*8]
mov ebx, ecx
cmp eax, 0x400
mov dword [ebp - 4], ebx
mov esi, 0x80
cmovbe esi, edx
push edi
cmp esi, dword [ebx]
jne 0x44831f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x599760]
test eax, eax
je 0x44832a
call eax
lea eax, [esi*8]
push eax
call fcn.00444bf0
mov ecx, dword [0x599764]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x44834b
call ecx
test esi, esi
je 0x448316
push dword [ebx + 0xc]
call fcn.00444ee0
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x5937a8]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.0051df40
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x44842e
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x4483bd
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x571ff0]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x4483a0
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x448408
mov eax, dword [esi]
test eax, eax
je 0x4483db
mov edx, dword [esi + 4]
jmp 0x4483dd
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x448408
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4483fd
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x448424
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x448424
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x44841a
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x448394
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x4485a4
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x448594
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x571ff0]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x448574
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x4485a6
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.00448440
add esp, 8
test eax, eax
je 0x4485c0
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4485d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x448625
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x448615
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x571ff0]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x4485f5
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x44862a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.00448440
add esp, 8
test eax, eax
je 0x448672
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x448662
push ebx
mov edx, eax
mov ecx, esi
call fcn.004484f0
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x448710
push 0x14
call fcn.00444bf0
mov edi, eax
add esp, 4
test edi, edi
jne 0x448696
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x4486d6
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x4486d6
add edx, edx
mov ecx, esi
call fcn.004482f0
test eax, eax
je 0x4486d6
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00448240
xor edx, edx
div dword [esi]
jmp 0x4486d9
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4486f7
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.00448280
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x448706
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x44f5f0
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x44f6f4
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x44f630
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.0051a6e0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
nop dword [eax]
test edi, edi
je 0x44f6f4
mov ebx, dword [edi + 0x10]
cmp ebx, dword [esi + 0x18]
ja 0x44f6e6
test byte [edi + 0x18], 0x20
jne 0x44f6e6
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.0051a6e0
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
cmp ebx, 1
jne 0x44f674
mov ecx, edi
call fcn.0044e8f0
mov ecx, dword [esi + 0xac]
test ecx, ecx
jne 0x44f686
mov edx, dword [edi + 4]
mov dword [ebp - 8], edx
jmp 0x44f6a0
push 6
push ebx
push dword [edi + 4]
push dword [esi + 0xb8]
call ecx
mov edx, eax
add esp, 0x10
mov dword [ebp - 8], edx
test edx, edx
je 0x44f6fd
push dword [ebp - 4]
mov ecx, dword [esi + 0x3c]
push dword [ebp - 0xc]
push dword [esi + 0x80]
mov eax, dword [ecx]
push edx
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x44f6ce
mov eax, dword [ebp - 8]
movups xmm0, xmmword [eax + 0x18]
movups xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x44f6d6
mov dword [esi + 0x20], ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
mov edx, ebx
call fcn.0045d730
add esp, 4
mov ebx, dword [ebp - 4]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x44f630
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f760
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jne 0x46f77b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x50
call fcn.004451f0
mov esi, eax
test esi, esi
je 0x46f772
push dword [ebp + 8]
mov edx, dword [edi]
mov ecx, ebx
call fcn.0046f2c0
add esp, 4
mov dword [esi], eax
mov edx, dword [edi + 8]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f430
add esp, 4
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f2a0
add esp, 4
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0x10]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f2c0
add esp, 4
mov dword [esi + 0x10], eax
mov edx, dword [edi + 0x14]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f2a0
add esp, 4
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f2c0
add esp, 4
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov ecx, ebx
mov byte [esi + 4], al
mov edx, dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.0046f760
add esp, 4
mov dword [esi + 0x1c], eax
test eax, eax
je 0x46f81b
mov dword [eax + 0x20], esi
push dword [ebp + 8]
mov dword [esi + 0x20], 0
mov ecx, ebx
mov edx, dword [edi + 0x28]
call fcn.0046f2a0
add esp, 4
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0x2c]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0046f2a0
mov dword [esi + 0x2c], eax
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0xfff7
mov dword [esi + 0x34], 0
mov ax, word [edi + 6]
and ax, cx
mov dword [esi + 0x24], 0
mov word [esi + 6], ax
mov eax, esi
pop edi
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, eax
test eax, eax
je 0x47686f
cmp byte [eax], dl
je 0x476867
inc edi
cmp byte [edi], dl
jne 0x476862
sub edi, eax
and edi, 0x3fffffff
xor ebx, ebx
cmp dword [esi + 4], edx
jle 0x47691b
nop word [eax + eax]
mov eax, ebx
mov ecx, ebx
xor eax, 1
cmp ebx, 2
cmovl ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x4768eb
mov edx, ecx
mov ecx, dword [esi + 8]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x4768cd
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x571ff0]
cmp cl, byte [edx + 0x571ff0]
jne 0x4768cd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4768b0
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 8]
movzx ecx, byte [ecx + 0x571ff0]
movzx eax, byte [eax + 0x571ff0]
sub eax, ecx
jne 0x47690e
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 8]
add ecx, ecx
mov edx, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00448550
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x47691b
jmp 0x476911
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 4]
jl 0x476880
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4769d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push ebx
push edi
mov edi, eax
test eax, eax
je 0x4769fd
cmp byte [eax], dl
je 0x4769f5
nop dword [eax]
inc edi
cmp byte [edi], dl
jne 0x4769f0
sub edi, eax
and edi, 0x3fffffff
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x476aa9
push esi
mov esi, dword [ecx + 8]
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov eax, ebx
xor ecx, 1
cmp ebx, 2
cmovl eax, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x476a7b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x476a60
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x571ff0]
cmp cl, byte [edx + 0x571ff0]
jne 0x476a5d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x476a40
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x571ff0]
movzx ecx, byte [ecx + 0x571ff0]
sub eax, ecx
jne 0x476a93
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea ecx, [eax + 0x18]
push edi
call fcn.00448550
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x476aa0
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x476a14
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
test edx, edx
je 0x476edd
test edi, edi
je 0x476d56
cmp dword [edi + 0x1f8], 0
jne 0x476d65
mov eax, 0xffff
add word [edx + 0x20], ax
jne 0x476edd
mov ebx, dword [edx + 0x10]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x476e52
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x24], eax
test edi, edi
je 0x476d8a
cmp dword [edi + 0x1f8], 0
jne 0x476e2f
mov esi, dword [ebx]
mov ecx, esi
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x476dae
cmp byte [esi], 0
je 0x476da6
nop word [eax + eax]
inc ecx
cmp byte [ecx], 0
jne 0x476da0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x24]
add eax, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
test edx, edx
je 0x476e08
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
test ecx, ecx
je 0x476df9
mov edi, ecx
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x571ff0]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x476dd3
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
jmp 0x476e0a
xor edx, edx
push edx
mov dword [ebp - 4], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.00448440
add esp, 8
test eax, eax
je 0x476e2f
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, eax
call fcn.004484f0
add esp, 4
push dword [ebx + 0x1c]
push edi
call fcn.00444f80
push ebx
push edi
call fcn.00444f80
mov eax, dword [ebp - 0x24]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, eax
test eax, eax
jne 0x476d73
mov ebx, dword [ebp - 0x28]
mov ecx, edi
mov edx, ebx
call fcn.00480cb0
mov edx, ebx
mov ecx, edi
call fcn.00476cc0
push dword [ebx]
push edi
call fcn.00444f80
push dword [ebx + 0x28]
push edi
call fcn.00444f80
mov edx, dword [ebx + 0x1c]
add esp, 0x10
mov ecx, edi
call fcn.00488240
mov edx, dword [ebx + 0x2c]
mov ecx, edi
call fcn.0046eee0
test edi, edi
je 0x476e9c
cmp dword [edi + 0x1f8], 0
jne 0x476ea5
mov edx, ebx
xor ecx, ecx
call fcn.00492de0
cmp dword [ebx + 0x3c], 0
je 0x476ed3
xor esi, esi
cmp dword [ebx + 0x38], esi
jle 0x476ec7
mov eax, dword [ebx + 0x3c]
push dword [eax + esi*4]
push edi
call fcn.00444f80
inc esi
add esp, 8
cmp esi, dword [ebx + 0x38]
jl 0x476eb2
push dword [ebx + 0x3c]
push edi
call fcn.00444f80
add esp, 8
push ebx
push edi
call fcn.00444f80
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a03d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5903c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 0x28], edx
mov ebx, dword [edi + 0x1c]
sub ebx, 6
mov dword [ebp - 0x34], ebx
test ebx, ebx
jle 0x4a0408
mov ecx, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
xor esi, esi
test ebx, ebx
jle 0x4a0452
mov ecx, 8
mov dword [ebp - 0x30], ecx
cmp edx, dword [edi + 0x1c]
ja 0x4a0594
cmp esi, ebx
jge 0x4a043e
cmp eax, 4
jge 0x4a043b
lea edx, [ecx + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc esi
mov dword [edi + edx*4], ecx
mov ecx, dword [ebp - 0x30]
inc eax
cmp esi, ebx
jl 0x4a0423
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x4a044e
inc edx
add ecx, eax
mov dword [ebp - 0x28], edx
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp esi, ebx
jl 0x4a0416
cmp edx, dword [edi + 0x1c]
ja 0x4a0594
mov esi, 0x571bf8
movzx ecx, byte [ebp + ebx*4 - 0x27]
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + str.cw]
mov byte [ebp - 0x24], dl
mov edx, 1
movzx ecx, byte [ebp + ebx*4 - 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + ebx*4 - 0x25]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + ebx*4 - 0x28]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
movzx ecx, byte [esi]
add esi, 4
xor byte [ebp - 0x24], cl
mov dword [ebp - 0x30], esi
cmp ebx, 8
je 0x4a04d0
cmp ebx, edx
jle 0x4a052e
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, ebx
jl 0x4a04c0
jmp 0x4a052e
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 4
jl 0x4a04d0
movzx ecx, byte [ebp - 0x18]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x14], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x13], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x12], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x11], cl
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 8
jl 0x4a0520
xor esi, esi
test ebx, ebx
jle 0x4a0585
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
lea edi, [edx*4 + 8]
cmp edx, dword [ecx + 0x1c]
ja 0x4a0582
cmp esi, ebx
jge 0x4a0571
nop word [eax + eax]
cmp eax, 4
jge 0x4a056b
mov ebx, dword [ebp - 0x2c]
lea edx, [edi + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [ebx + edx*4], ecx
mov ebx, dword [ebp - 0x34]
cmp esi, ebx
jl 0x4a0550
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x4a057e
inc edx
add edi, eax
mov dword [ebp - 0x28], edx
xor eax, eax
cmp esi, ebx
jl 0x4a0541
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmp ecx, dword [edi + 0x1c]
jbe 0x4a0460
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00519876
mov esp, ebp
pop ebp
ret
Function at 0x4a05b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
mov ebx, 1
cmp dword [edi + 0x1c], ebx
jbe 0x4a069a
lea eax, [edi + 0x32]
push esi
nop word [eax + eax]
movzx ecx, byte [eax + 1]
lea eax, [eax + 0x10]
movzx edx, byte [eax - 0x11]
inc ebx
mov esi, dword [ecx*4 + 0x594590]
xor esi, dword [edx*4 + 0x593870]
movzx ecx, byte [eax - 0x10]
xor esi, dword [ecx*4 + 0x591cc8]
movzx ecx, byte [eax - 0x12]
xor esi, dword [ecx*4 + 0x594990]
mov dword [eax - 0x12], esi
movzx ecx, byte [eax - 0xb]
movzx edx, byte [eax - 0xc]
mov esi, dword [ecx*4 + 0x594590]
xor esi, dword [edx*4 + 0x591cc8]
movzx ecx, byte [eax - 0xd]
xor esi, dword [ecx*4 + 0x593870]
movzx ecx, byte [eax - 0xe]
xor esi, dword [ecx*4 + 0x594990]
mov dword [eax - 0xe], esi
movzx ecx, byte [eax - 7]
movzx edx, byte [eax - 8]
mov esi, dword [ecx*4 + 0x594590]
xor esi, dword [edx*4 + 0x591cc8]
movzx ecx, byte [eax - 9]
xor esi, dword [ecx*4 + 0x593870]
movzx ecx, byte [eax - 0xa]
xor esi, dword [ecx*4 + 0x594990]
mov dword [eax - 0xa], esi
movzx ecx, byte [eax - 3]
movzx edx, byte [eax - 4]
mov esi, dword [ecx*4 + 0x594590]
movzx ecx, byte [eax - 5]
xor esi, dword [edx*4 + 0x591cc8]
xor esi, dword [ecx*4 + 0x593870]
movzx ecx, byte [eax - 6]
xor esi, dword [ecx*4 + 0x594990]
mov dword [eax - 6], esi
cmp ebx, dword [edi + 0x1c]
jb 0x4a05d0
pop esi
pop edi
pop ebx
ret
Function at 0x4a10d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x5903c4]
xor eax, esp
mov dword [esp + 0xb0], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x94], 0x6a09e667
lea ecx, [esp + 0xc]
mov dword [esp + 0x98], 0xbb67ae85
mov dword [esp + 0x9c], 0x3c6ef372
mov dword [esp + 0xa0], 0xa54ff53a
mov dword [esp + 0xa4], 0x510e527f
mov dword [esp + 0xa8], 0x9b05688c
mov dword [esp + 0xac], 0x1f83d9ab
mov dword [esp + 0xb0], 0x5be0cd19
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.004a1190
add esp, 4
lea ecx, [esp + 8]
mov edx, esi
call fcn.004a1230
mov ecx, dword [esp + 0xb4]
pop esi
xor ecx, esp
call fcn.00519876
mov esp, ebp
pop ebp
ret

Function at 0x4a1ce0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x5903c4]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov esi, dword [ebp + 0xc]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004a1510
add esp, 4
lea edx, [esp + 8]
mov ecx, esi
call fcn.004a1460
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00519876
mov esp, ebp
pop ebp
ret