joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47177c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00470e7c
xor eax, eax
push ebp
push 0x471904
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4718ee
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4717c8
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4717d2
call fcn.00404c78
jmp 0x47190b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ad00
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4718e3
mov edx, dword [0x4db0b4]
mov eax, 0x4db0c0
mov ecx, 5
call fcn.0040331c
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x471896
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x471883
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404554
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00471734
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x471918]
cmp dl, byte [eax + 0x28]
je 0x4718ea
call fcn.0040f678
jmp 0x4718ea
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ad20
jmp 0x4718ea
cmp edi, ebx
jge 0x4718b2
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ad20
jmp 0x4717d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ad00
cmp edx, dword [esp + 4]
jne 0x4718d2
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4717d2
push ebp
call fcn.00471734
pop ecx
jmp 0x4718ea
push ebp
call fcn.00471734
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47190b
mov eax, dword [ebp - 4]
call fcn.00470e88
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47191c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471a53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00470e7c
xor eax, eax
push ebp
push 0x471a36
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47196c
call fcn.00404c78
jmp 0x471a3d
mov edx, dword [0x4db0b4]
mov eax, 0x4db0c0
mov ecx, 5
call fcn.0040331c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x471a20
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x471a20
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404554
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x471a20
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040ee60
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x471a6c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4d3710]
mov dl, 1
mov eax, dword [0x46f86c]
call fcn.0040f790
call fcn.00404bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471a3d
mov eax, dword [ebp - 4]
call fcn.00470e88
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471a5a
lea eax, [ebp - 0x28]
call fcn.0040525c
ret
Function at 0x471abc
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471c1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00470e7c
xor eax, eax
push ebp
push 0x471bfe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x471b21
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x471b21
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x471be8
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x471b34
call fcn.00404c78
jmp 0x471c05
mov edx, dword [0x4db0b8]
mov eax, 0x4db0c8
mov ecx, 5
call fcn.0040331c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x471be8
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x471be8
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404554
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x471be8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040ee60
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x471c34
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4d3710]
mov dl, 1
mov eax, dword [0x46f86c]
call fcn.0040f790
call fcn.00404bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471c05
mov eax, dword [ebp - 4]
call fcn.00470e88
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471c22
lea eax, [ebp - 0x28]
call fcn.0040525c
ret
Function at 0x47363c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push 0x473708
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x473705
push 0x473714
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db0b8], eax
push 0x4db0e0
push 0x40
push 8
mov eax, dword [0x4db0b8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x47368d
mov edx, 0x4db0c8
mov eax, dword [0x4db0b8]
mov ecx, 5
call fcn.0040331c
push 0x47371c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db0b4], eax
push 0x4db0d8
push 0x40
push 8
mov eax, dword [0x4db0b4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4736c9
mov edx, 0x4db0c0
mov eax, dword [0x4db0b4]
mov ecx, 5
call fcn.0040331c
push 0x473724
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db0bc], eax
push 0x4db0e8
push 0x40
push 8
mov eax, dword [0x4db0bc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x473705
mov edx, 0x4db0d0
mov eax, dword [0x4db0bc]
mov ecx, 5
call fcn.0040331c
pop ebx
ret

Function at 0x47c068
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
movzx ebx, word [0x4c1524]
cmp dword [esp], 0x20
jge 0x47c0ac
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x47c0ef
inc edx
xor esi, esi
movzx edi, bx
shr edi, 8
movzx edi, word [edi*2 + 0x4c1324]
shl ebx, 8
xor di, bx
movzx ebx, byte [eax + esi]
xor di, bx
mov ebx, edi
inc esi
dec edx
jne 0x47c089
jmp 0x47c0ef
mov edx, dword [esp]
test edx, edx
jns 0x47c0b6
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x47c0ef
movzx edi, bx
shr edi, 8
movzx edi, word [edi*2 + 0x4c1324]
shl ebx, 8
xor di, bx
movzx ebx, byte [eax + esi]
xor di, bx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x47c0ca
mov esi, 2
movzx eax, bx
shr eax, 8
movzx eax, word [eax*2 + 0x4c1324]
shl ebx, 8
xor ax, bx
movzx edx, cx
shr edx, 8
xor ax, dx
mov ebx, eax
shl cx, 8
dec esi
jne 0x47c0f4
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x47c124
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, dword [0x4c1928]
cmp dword [esp], 0x20
jge 0x47c163
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x47c1a2
inc edx
xor esi, esi
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + 0x4c1528]
shl ebx, 8
xor edi, ebx
movzx ebx, byte [eax + esi]
xor edi, ebx
mov ebx, edi
inc esi
dec edx
jne 0x47c144
jmp 0x47c1a2
mov edx, dword [esp]
test edx, edx
jns 0x47c16d
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x47c1a2
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + 0x4c1528]
shl ebx, 8
xor edi, ebx
movzx ebx, byte [eax + esi]
xor edi, ebx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x47c181
mov esi, 4
mov eax, ebx
shr eax, 0x18
mov eax, dword [eax*4 + 0x4c1528]
shl ebx, 8
xor eax, ebx
mov edx, ecx
shr edx, 0x18
xor eax, edx
mov ebx, eax
shl ecx, 8
dec esi
jne 0x47c1a7
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x47ef8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x47efb9
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x47f038
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0047d410
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47f006
mov cx, word [esp]
sub cx, si
jmp 0x47f008
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47efef
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47f02e
mov cx, word [esp]
sub cx, si
jmp 0x47f030
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47f017
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x47f095
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0047ec60
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x47f080
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x47f095
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x47ef96
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x484af4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x484b15
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x484b02
pop edi
pop esi
pop ebx
ret
Function at 0x486bfc
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x486c96
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x486c1b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x486cac
dec edx
je 0x486ce1
jmp 0x486d32
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x486d32
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4872f4
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x4c6da0
mov ecx, 0x48
call fcn.0040331c
lea edx, [ebp + 0x48]
mov eax, 0x4c6de8
mov ecx, 0x1000
call fcn.0040331c
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x48734e
xor edi, edi
dec eax
jne 0x48733c
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x487335
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004873d0
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x48736c
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004873d0
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x487397
add ebx, 0x400
dec edi
jne 0x487395
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4873d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.0040331c
cmp byte [esp], 0
je 0x487474
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4873fe
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4874f1
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x48747f
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x487cd4
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.0040331c
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.0040331c
add esp, 0x58
pop ebx
ret

Function at 0x4882fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x4c7e28
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call sub.kernel32.dll_GetLocalTime
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
movzx eax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
movzx edx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x48830c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48b7a8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x48b8df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x48b807
lea edx, [ebp - 0x100c]
mov eax, dword [0x4d32e0]
call fcn.0040711c
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x40a834]
call fcn.0040f698
call fcn.00404bcc
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x48b85f
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x48b834
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x48b85a
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x48b847
inc esi
add ecx, esi
jmp 0x48b869
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x48b89f
lea edx, [ebp - 0x1010]
mov eax, dword [0x4d32e0]
call fcn.0040711c
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x40a834]
call fcn.0040f698
call fcn.00404bcc
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040331c
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.0040331c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b8e6
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405280
ret

Function at 0x48d0ac
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x4ca294
movzx edx, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x48d0ba
xor ebx, ebx
mov ecx, 0x4c9e94
mov eax, ebx
mov edx, 8
test al, 1
je 0x48d0e9
shr eax, 1
xor eax, esi
jmp 0x48d0eb
shr eax, 1
dec edx
jne 0x48d0df
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x48d0d8
pop esi
pop ebx
ret
Function at 0x48d100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x4c9e94
test esi, esi
je 0x48d115
test edi, edi
jg 0x48d11c
xor eax, eax
jmp 0x48d21b
mov ebx, 0xdbc66688
cmp dword [0x4c9e90], 0
je 0x48d12f
call fcn.0048d0ac
xor ebx, 0xffffffff
cmp edi, 8
jl 0x48d1f7
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x48d13b
test edi, edi
je 0x48d216
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x48d1fb
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48d260
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4ca2a0]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x48d28b
add esp, 0xc
pop edi
pop esi
pop ebx
ret