joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467574
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4186d4]
call fcn.004053a0
xor eax, eax
push ebp
push 0x4676b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x498570], 0
jne 0x4675c7
mov ecx, dword [0x4a263c]
mov dl, 1
mov eax, dword [0x40a578]
call fcn.0040f464
call fcn.00404430
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040362c
mov eax, ebx
call fcn.0040526c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4676c8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040656c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040527c
test eax, eax
jle 0x46765f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x467658
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404ca4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404c8c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040b408
test eax, eax
jne 0x467658
mov ebx, 0x15
jmp 0x467664
mov ebx, 0x10
jmp 0x467664
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x498570]
call fcn.0046741c
mov eax, dword [ebp - 8]
call fcn.0046741c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4676bf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404a40
lea eax, [ebp - 0x10]
mov edx, dword [0x4186d4]
call fcn.00405470
ret
Function at 0x4721dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
test dl, dl
je 0x4721f0
add esp, 0xfffffff0
call fcn.00403fc8
mov byte [ebp - 1], dl
mov esi, eax
mov byte [esi + 0x429], 1
xor edx, edx
mov eax, esi
call fcn.0046a734
call fcn.00470ef4
push esi
push 0x4723fc
call fcn.004224fc
mov dword [esi + 0x424], eax
mov dl, 1
mov eax, dword [0x470100]
call fcn.00403c60
mov dword [esi + 0x308], eax
mov dl, 1
mov eax, dword [0x46fffc]
call fcn.00403c60
mov edx, dword [esi + 0x308]
mov dword [edx + 0x10], eax
mov dl, 1
mov eax, dword [0x4197cc]
call fcn.00403c60
mov ebx, eax
mov eax, dword [esi + 0x308]
mov dword [eax + 4], ebx
mov eax, ebx
mov edx, 0x4722e4
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xb]
xor ecx, ecx
mov edx, 0xa
call fcn.0040362c
push 0xa
lea eax, [ebp - 0xb]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [ebp - 0xb], 0x31
jne 0x472295
mov byte [esi + 0x420], 1
jmp 0x47229c
mov byte [esi + 0x420], 0
mov edx, dword [0x4722f4]
mov eax, esi
call fcn.004727e8
mov edx, dword [0x4722f8]
mov eax, esi
call fcn.0047287c
mov byte [esi + 0x428], 0
mov eax, esi
cmp byte [ebp - 1], 0
je 0x4722d4
call fcn.00404020
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4781d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x478231
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b478
cmp dword [ebp - 4], 0
je 0x47821b
push 1
push 0x47823c
push 0x47823c
mov eax, ebx
call fcn.00404edc
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478238
lea eax, [ebp - 4]
call fcn.00404a1c
ret

Function at 0x47b34c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x47b3a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404edc
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x47b38d
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x47b38f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b3ac
lea eax, [ebp - 4]
call fcn.00404a1c
ret

Function at 0x47b3b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x47b418
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp - 4]
call fcn.00404edc
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040c3b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b41f
lea eax, [ebp - 4]
call fcn.00404a1c
ret
Function at 0x47ba94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x47bb90
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.0047b244
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047935c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047c7a0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00479310
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047c818
lea eax, [ebx + 0x50]
call fcn.00404a1c
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bb97
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a40
ret
Function at 0x47bba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x47bcac
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.0047b244
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47bc6f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047935c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047c7a0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00479310
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047c818
jmp 0x47bc81
xor edx, edx
mov eax, ebx
call fcn.0047c7a0
xor edx, edx
mov eax, ebx
call fcn.0047c818
lea eax, [ebx + 0x50]
call fcn.00404a1c
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bcb3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a40
ret
Function at 0x47d6ed
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x47ef52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x47f000
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x47ef91
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.0047d7cd
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.0047d3c8
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x47efbc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.0047d6ed
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.0047d731
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x47f01b
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047d731
add esp, 0xc
pop ecx
pop ebp
ret

Function at 0x47f01e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x47f03f
push dword [ebp + 0x10]
push 0
push 0
call fcn.0047ef52
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0047d7cd
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x47f057
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.0047d6ed
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.0047d731
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.0047d731
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0047d7cd
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x47f0de
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x47f0c3
mov esp, ebp
pop ebp
ret
Function at 0x480584
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.0047eea0
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047eeb7
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.0047d3e0
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0047ef52
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x480718
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.0047d3c8
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.0047d3e0
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x4806d2
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.0047ef52
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047f01e
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x480695
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.0047d3e0
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x480665
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x4806fb
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x480709
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x4806e5
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x480601
mov esp, ebp
pop ebp
ret

Function at 0x485efc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0048614c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0048614c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret
Function at 0x485f70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x485fa3
mov edi, ecx
dec edi
test edi, edi
jl 0x485fb4
inc edi
mov eax, esi
call fcn.00485f54
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, esi
call fcn.00485efc
inc ebx
dec edi
jne 0x485f8b
jmp 0x485fb4
lea eax, [esi + 0x3bc]
push eax
push ecx
push ebx
call fcn.0047db60
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x486040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x4860b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00485fb8
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00485f54
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00485efc
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x486080
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4860bc
lea eax, [ebp - 4]
call fcn.00404a1c
ret
Function at 0x486c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x486e19
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x486dd5
mov eax, dword [ebp - 4]
call fcn.004883d4
cmp ebx, eax
jge 0x486dd5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00479adc
mov edx, dword [0x47b4bc]
call fcn.00403e4c
mov esi, eax
mov eax, esi
call fcn.0047c704
test al, al
je 0x486dcb
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
call fcn.00404cdc
test eax, eax
jne 0x486dbe
xor eax, eax
push ebp
push 0x486db7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004871bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041d5a4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405068
mov eax, dword [ebp - 8]
call fcn.00404f34
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00486f98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486e03
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x486db6
mov eax, dword [ebp - 4]
call fcn.00487240
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00404a70
jmp 0x486e03
mov eax, dword [ebp - 8]
call fcn.00404a1c
jmp 0x486e03
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040b9cc
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x419188]
call fcn.0040f3e4
call fcn.00404430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486e20
lea eax, [ebp - 0x54]
call fcn.00404a1c
ret
Function at 0x48d9e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push edi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, 0
mov edi, dword [0x4a7000]
shl edi, 2
xor edx, dword [esi + 0x4a5f78]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x4a6000]
mov bl, dl
add ecx, dword [ebx*4 + 0x4a6400]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x4a6800]
mov bl, dl
add ecx, dword [ebx*4 + 0x4a6c00]
xor eax, ecx
xchg edx, eax
add esi, 4
cmp esi, edi
jne 0x48da05
xchg edx, eax
xor eax, dword [esi + 0x4a5f78]
xor edx, dword [esi + 0x4a5f7c]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x48da60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, dword [0x4a7000]
inc esi
shl esi, 2
xor edx, dword [esi + 0x4a5f78]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x4a6000]
mov bl, dl
add ecx, dword [ebx*4 + 0x4a6400]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x4a6800]
mov bl, dl
add ecx, dword [ebx*4 + 0x4a6c00]
xor eax, ecx
xchg edx, eax
sub esi, 4
cmp esi, 4
jne 0x48da78
xchg edx, eax
xor eax, dword [0x4a5f7c]
xor edx, dword [0x4a5f78]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop esi
pop ecx
pop ebx
ret
Function at 0x48dd58
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x4a7000], 0x10
mov esi, 0x49ed7c
mov edi, 0x4a5f78
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x48ebf4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00403168
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x48ed50
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x48ec46
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00403168
add esp, 0x30
pop edi
pop esi
pop ebx
ret