joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0172
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4a
ja 0x4a038c
and dword [ebx - 0x23], edi
sbb byte [edi], ch
enter 0xffffffffffffd2d6, 0x5b
je 0x4a0211
sub eax, 0xa4d06db3
sbb dl, byte [esi + eax*4]
invalid
inc ebp
push es
xchg esp, eax
sub dword [eax - 0x166bed37], esp
mov word [0x36776f61], gs
mov ebx, 0xb806a8fd
imul ebp, dword [eax - 0x1f], 0x18
ror dword [ebx - 0x38], 0xf2
ret 0xb4d9
mov edi, dword [ebp + 8]
and dword [ebx], 0
and dword [edi], 0
call fcn.004ae8cf
cmp dword [eax + 0x278], 0
je 0x4a0439
call fcn.004ae8cf
cmp dword [eax + 0x280], 0
je 0x4a0439
cmp dword [esi + 0x14], 8
jb 0x4a03c1
mov esi, dword [esi]
call fcn.004ae8cf
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [eax + 0x278]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a0439
test esi, esi
je 0x4a0439
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
jle 0x4a0432
cmp eax, 0xffffffff
je 0x4a0432
cmp eax, 0xfa000
jge 0x4a0432
add eax, 5
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x4a0432
call fcn.004ae8cf
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi]
push dword [ebx]
push esi
call dword [eax + 0x280]
mov eax, dword [ebp - 4]
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a0809
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xe
rcl byte fs:[eax + eax - 0x7d]
clc
push cs
ja 0x4a0a20
inc esp
out 0x78, eax
xchg dword [eax + 0x13f8cea8], ecx
test al, 0x28
sbb eax, 0x22d13e4e
and dword [ebx], 0x2795a9ee
pushal
sbb al, 0x1e
and ch, bl
inc edx
cdq
xchg edi, eax
adc ecx, esi
adc edx, dword [esi - 0x3c]
dec ecx
add ebp, eax
sub eax, 0x4bfc88f5
leave
mov edx, 0xb5971f98
mov edx, 0x404af3bc
sahf
cmp ebp, esi
add eax, 0x4d0fd23c
loopne 0x4a0814
inc ebp
arpl word [edi + 0x24804925], si
int3
xor eax, eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x1c], 0x6054b50
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov dword [ebp - 4], eax
jb 0x4a0a44
mov esi, dword [esi]
push 0x55a6ec
lea eax, [ebp - 4]
push esi
push eax
call fcn.0041d640
add esp, 0xc
cmp dword [ebp - 4], 0
pop esi
je 0x4a0a78
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push 1
push 0x16
push eax
call fcn.0041e5d2
push dword [ebp - 4]
call fcn.0041ea82
add esp, 0x14
leave
ret
Function at 0x4a1c3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x548cd8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x65
ja 0x4a1e6b
add dl, cl
ja 0x4a1c32
sahf
mov esp, 0x932b547f
ret
xor ebx, ebx
push ebx
xor eax, eax
push 0x553ec0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
call fcn.00402a1d
mov dword [esp + 0x34], ebx
cmp dword [edi + 0x2034], ebx
je 0x4a1f27
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a1ebd
cmp byte [edi + 0x2020], bl
je 0x4a1ebd
push esi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004a1f48
mov bl, al
xor edx, edx
test esi, esi
je 0x4a1ecb
mov ecx, dword [esi]
test ecx, ecx
je 0x4a1ecb
mov edx, dword [ecx]
test bl, bl
je 0x4a1edf
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
jmp 0x4a1ee1
xor eax, eax
push 0x4a043e
push eax
push edx
push dword [ebp + 8]
call dword [edi + 0x2034]
add esp, 0x10
test bl, bl
je 0x4a1f27
cmp dword [esp + 0x20], 0
je 0x4a1f27
call fcn.004ae8cf
cmp dword [eax + 0x164], 0
je 0x4a1f27
cmp dword [esp + 0x24], 8
lea esi, [esp + 0x10]
cmovae esi, dword [esp + 0x10]
call fcn.004ae8cf
push esi
call dword [eax + 0x164]
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.004023ba
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a3f9a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x26
ja 0x4a307b
adc eax, 0xc2e7bc9e
dec eax
in eax, 0x32
int3
mov ecx, dword [esi + 0x2040]
test ecx, ecx
je 0x4a3098
mov eax, dword [0x576634]
test eax, eax
je 0x4a3098
push ecx
call eax
and dword [esi + 0x2040], 0
pop esi
ret
enter 0x5c38, 0xa
sbb al, 0xcd
wait
inc ecx
or ebp, dword [esp + edi + 0xe2bce9]
test eax, 0x8a155094
leave
arpl word [esp + eax*4], ax
invalid
and dh, byte [edx + 0x2c1aee3a]
invalid
push esi
mov esi, ecx
mov dword [esi], vtable.CrashDetectorNS::CrashDetector.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x41
ja 0x4a41b1
push cs
add cl, dl
jl 0x4a4032
test eax, 0xb0f1de49
aas
sbb eax, 0x5e65080e
jae 0x4a3f68
jbe 0x4a3f86
sar byte [eax], cl
jecxz 0x4a4009
dec eax
inc ecx
invalid
rcl dword [ebx - 0x1e5e84a3]
js 0x4a406e
mov al, byte [0xed31e930]
xor byte [eax + 0x4b], dh
salc
or ah, byte [eax + 0x3e]
stc
hlt
imul ebp, dword [0xba94149a], 0xffaacc08
jecxz 0x4a40bb
adc dl, byte [edi - 0x654bcb14]
js 0x4a4053
retf
and al, 0x29
or esi, ecx
ror edi, 0xe1
sub eax, 0x31c00835
adc byte [esi + 0x6f], 0x92
dec esi
pushal
dec edi
inc eax
sahf
lahf
cmp eax, 0xb85be2b0
je 0x4a40a2
salc
inc esi
pmovmskb eax, mm7
adc eax, dword [edi]
or eax, 0x73cdc09
xchg ebp, eax
or esi, dword [edi + 0x34]
scasb al, byte es:[edi]
and al, 0x46
rcr dword [ebx + 0x5f], 8
pop edi
sbb dl, byte [edi + 0x62d34644]
aas
jns 0x4a409c
or ch, 0x4c
pop edx
jl 0x4a40fe
and al, 0x1f
xchg byte [esi + 0x7f], bh
jb 0x4a4044
sysenter
pop edx
xor al, 0x5a
sbb dword [eax - 5], edi
js 0x4a409f
inc eax
mov ch, byte [edi]
movsb byte es:[edi], byte [esi]
add ebx, edi
ror dword [edi], cl
add byte [ebp - 0x2c], ch
dec ecx
loop 0x4a410f
invalid
movsb byte es:[edi], byte [esi]
xchg ecx, ebx
pop ds
or al, ah
pop ss
iretd
dec ecx
pop edx
outsb dx, byte [esi]
dec ebp
lea esp, [esi + 0x54ff837d]
lodsd eax, dword [esi]
mov dword [ebp - 0x3d], ebp
insb byte es:[edi], dx
popal
in eax, 0xa0
dec ecx
mov al, 0x83
xchg dword fs:[0xffffa223], ebx
mov al, byte [0x6483b049]
xchg dword fs:[0xffffa223], ebx
stosb byte es:[edi], al
jae 0x4a4144
sal dword [ebx + 0x45157fe3], 1
dec esi
sbb ebp, ebp
sti
mov dh, 0x83
adc dword [edi + 0x369ec946], esi
xchg ebx, eax
mov ebx, 0x5e23e874
fdiv st(7), st(0)
sub al, 0x98
outsd dx, dword [esi]
invalid
sub eax, dword [eax + 0x79]
sal byte [eax - 0x6c], 1
dec edi
sbb dh, byte [ecx + 0x37]
mov ah, 0x41
aas
inc esp
aam 0xbe
pushal
invalid
mov eax, dword [esi + 0x201c]
test eax, eax
je 0x4a41c7
cmp eax, 0xffffffff
je 0x4a41c7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
pop esi
jmp 0x4a2e6a

Function at 0x4a41cf
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x5767a0], vtable.CrashDetectorNS::CrashDetector.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x62
ja 0x4a43e7
ror dword [0x530c51ed], cl
mov word [edx + 0x23], gs
sub ch, ah
ror dword [ecx + 0x366a054], cl
invalid
sub esp, 0xc
push 0x46342d
push ecx
push ecx
call int.004a3866
mov eax, 0x5767a0
ret 0x18
Function at 0x4a4cab
Capabilities:
Check for time delay via gettickcount

Disassembly:
add byte [edi + 0x5e], bl
xor eax, eax
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x57
ja 0x4a4eb9
insd dword es:[edi], dx
xchg esp, eax
dec esi
xor edx, 0x837c9ef5
stc
cmpsd dword [esi], dword es:[edi]
pop esp
xor bh, byte [esi]
cmp al, ah
inc eax
das
sub al, 8
pop ds
imul ebp, dword [eax + 0x45], 0x18beaed3
pop ss
loopne 0x4a4d44
xchg edi, eax
popal
lahf
jmp 0x4a4ca1
daa
movsd dword es:[edi], dword [esi]
clc
pop es
jbe 0x4a4d64
pushfd
stosb byte es:[edi], al
and ecx, ecx
fucomp st(7)
jnp 0x4a4d9c
ret 0xe691
dec ecx
sub eax, 0xec4ea305
mov dword [0x9f9ffb78], eax
mov ebp, edi
ja 0x4a4d85
rcl al, 0x99
ret 0xeb6c
sar dh, cl
fiadd word [ecx + 0x3dc0af83]
push 0x8ac4ff5
mov ch, byte [edi - 0xe]
mov cl, byte [ebp - 0x6d]
and dword [0xd7dfd6e4], 0x5aaa48a5
mov bh, 0x85
fst dword [esp + esi*2 - 0x73]
je 0x4a4d14
inc esp
into
adc cl, bh
out 0x83, eax
xchg dword [edx - 0x37], esp
cdq
dec edx
inc ebp
invalid
daa
inc edx
cmp byte [ebx + ebx*4], dh
sub al, 0x12
jae 0x4a4d88
push edi
push 0xffffffffffffffbf
inc ecx
test eax, 0xcaef6b5d
mov bh, 0x64
xor esi, dword [edx - 0x17da03df]
cwde
nop
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cdq
mov ecx, 0x3e8
idiv ecx
xor eax, eax
cmp edx, 0x7d0
setg al
ret
Function at 0x4a6dd8
Capabilities:
Check for time delay via gettickcount

Disassembly:
add al, byte [eax + 0x3b]
sar dword [esi - 0xf], 0x2b
mov dh, 4
cmp byte [eax], al
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x51
ja 0x4a6ff1
cmp eax, 0x501c03cd
sub esp, dword [edi + eax*8 + 0x26]
pushal
fisttp word [ebp - 0xd]
and al, 0x59
into
loope 0x4a6e45
test byte [edi], al
dec esi
clc
mov al, 0xd3
xor al, 0xa0
in al, 0xf2
call 0x8549ba3
aas
jmp 0x4a6dc5
pushfd
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x1a227c97]
cmpsb byte [esi], byte es:[edi]
pop ss
xor eax, dword [esi - 0x70455833]
sbb cl, dl
push edi
cmpsb byte [esi], byte es:[edi]
inc edi
sub bl, ch
movsb byte es:[edi], byte [esi]
fdiv st(1), st(0)
add esi, dword [ecx + 0x655d3f72]
push eax
hlt
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.004ae8cf
cmp dword [eax + 0xe0], 0
jne 0x4a700a
or eax, 0xffffffff
jmp 0x4a702b
call fcn.004ae8cf
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
push 1
push esi
push edi
call dword [eax + 0xe0]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x4a702f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3c
ja 0x4a7248
sub byte [edx + 0x3a660df7], dl
push ss
lodsb al, byte [esi]
xlatb
aas
cmp eax, 0xc6f5e4cf
jnp 0x4a70a9
cmpsd dword [esi], dword es:[edi]
sbb al, byte [edx + 0x5419d074]
into
lea edi, [eax + ebx - 0x307ac44]
test ebp, ebx
out 0xc9, al
lcall 0x7124, 0x1cba2269
mov ds, word [esi + 0x2cdca6e3]
adc eax, esi
cmpsd dword [esi], dword es:[edi]
invalid
dec esp
adc dword [eax - 0x48cb35c3], esi
sbb bl, byte [eax - 0x60382727]
fcomp st(2)
invalid
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.004ae8cf
cmp dword [eax + 0xdc], 0
jne 0x4a7261
or eax, 0xffffffff
jmp 0x4a7281
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
push 0x40000001
push esi
push edi
call dword [eax + 0xdc]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x4a7ee8
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1b
ja 0x4a80ff
mov ch, 0xa4
mov dl, 0xa4
imul edi, dword [ecx - 0x62], 0xb31903de
add al, 0xa6
sub eax, 0x417d25c5
add byte [ecx - 0x5f], dl
sbb ah, ch
xchg esi, eax
cmp eax, 0xf02e8f49
add byte [ebx], bh
div byte [edx + 0x25]
pop es
and bh, byte [ebx - 0x5b]
cli
das
loopne 0x4a7f35
inc ebp
sbb bh, bh
push ecx
enter 0x5ed0, 0xfffffffffffffff5
fsub st(5)
invalid
push eax
inc eax
mov byte [edi + 0x24], dl
test dword [edi - 0x50908bf1], esi
dec ecx
cwde
les esp, [edi - 0x42a86f49]
dec ecx
cdq
inc ecx
xor dword [esi + 0x7dd16ffe], edx
xor dword [ebp - 0x4c], ebx
or al, 0x1a
and byte [ebx], ch
mov al, byte [0x4ef5aaaf]
lds ecx, [edx - 0x4e]
and byte [0xe3e69a72], 0xbd
outsd dx, dword [esi]
xchg bl, ch
xor byte [eax + 0x10c1dd31], dh
and bl, byte [ebx]
adc eax, 0x8e20e027
bound dx, dword [ebx]
test dword [eax + 0x77], edx
wait
aam 0xe7
neg byte gs:[eax + 0x3545d065]
sub eax, 0x19a2ade
cdq
xchg ebp, eax
invalid
cmp dword [ebp + 8], 0
je 0x4a8176
call fcn.004ae8cf
cmp dword [eax + 0x39c], 0
je 0x4a8176
mov dword [ebp - 0x50], 0x44
call fcn.004ae8cf
lea ecx, [ebp - 0x50]
push ecx
call dword [eax + 0x39c]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
test eax, eax
je 0x4a8176
xor ebx, ebx
mov ecx, eax
cmp byte [eax], bl
je 0x4a8176
inc ecx
inc ebx
cmp byte [ecx], 0
jne 0x4a813b
test ebx, ebx
jle 0x4a8176
lea esi, [ebx + 1]
push esi
call fcn.00417f6a
pop ecx
push esi
mov edi, eax
push 0
push edi
call fcn.0041b930
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, ebx
push esi
push edi
call fcn.004a6dd8
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4b2e2f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.NCompress::CCopyCoder.0
mov dword [esi + 4], vtable.NCompress::CCopyCoder.1.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3d
ja 0x4b304d
das
push eax
dec esp
xor byte [ecx], dh
xchg esp, eax
call 0x5544debe
lea esi, [0x931187b3]
sbb al, 3
mov esp, 0x1f06f978
inc ebx
inc dword [0x56961534]
inc ecx
sub ebx, esp
sub eax, 0xc9ed6bff
cld
cmp al, 0x62
out dx, eax
wait
pop ss
cwde
sub dword [edx + esi - 0x19], ebp
mov dword [0x755d600d], eax
xor dword [edx + 0x50], esp
hlt
mov ecx, dword [esi + 0xc]
pop esi
jmp fcn.004c3f90
Function at 0x4b5fa2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xb
ja 0x4b61b3
sbb esp, eax
mov eax, dword [0xf6b04063]
dec edi
not dword [esp + ebp*8 + 9]
xor ch, byte [ecx + 0x13bdfd25]
add byte [ebx + 0x17], bl
jmp 0x31d01bdd
lea ecx, [esi + 0x10]
call fcn.004b3f36
test eax, eax
jne 0x4b61f8
lea ecx, [esi + 0x38]
call fcn.004b3f36
test eax, eax
jne 0x4b61f8
lea ecx, [esi + 0x60]
call fcn.004b3f36
test eax, eax
jne 0x4b61f8
push ebx
push edi
push 5
pop edi
lea ecx, [esi + 0x88]
call fcn.0040df33
dec edi
jne 0x4b61dc
pop edi
pop ebx
lea ecx, [esi + 0xa0]
pop esi
jmp fcn.004b3f36
pop esi
ret

Function at 0x4b668f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5490ca
call fcn.0054565c
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], vtable.ICompressSetBufSize.0
mov dword [esi + 8], eax
mov dword [esi], vtable.NCompress::NBcj2::CDecoder.0
mov dword [esi + 4], vtable.NCompress::NBcj2::CDecoder.1.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], eax
push eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x4a0], eax
mov dword [esi + 0x4a4], eax
mov dword [esi + 0x4b4], eax
mov dword [esi + 0x4c0], eax
mov dword [esi + 0x4d8], 0x10000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add byte [ecx + 0x4a486], cl
add byte [ecx + 0x4b486], cl
add byte [ecx + 0x4c086], cl
add bh, al
xchg al, bl
add al, 0
add byte [eax], al
add byte [ecx], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetTickCount
cmp eax, 0x1f
ja 0x4b6925
dec ebx
sti
inc edx
lcall 0x986d, 0x94a4de77
loopne 0x4b670e
loopne 0x4b66d6
loope 0x4b66fa
test eax, 0xe7cf0fc
and cl, ah
inc ebp
shr ecx, cl
xchg esi, eax
xor al, 0x1b
adc edx, dword [esi + 0x7b]
invalid
mov ecx, dword [ebp - 0xc]
mov eax, 0x100000
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4b9d2d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edx
mov edx, ecx
or ecx, 0xffffffff
call dword [0x5788e8]
not eax
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5d
ja 0x4b9f3c
mov ebx, 0x96d35c8a
or esp, edx
push 0x844dc8a1
jp 0x4b9d45
mov eax, dword [0x7a844dc8]
cli
ror byte [ebp - 6], 0x25
test byte [edi + 0x5c], dh
movsd dword es:[edi], dword [esi]
dec edi
outsd dx, dword [esi]
mov eax, dword [0x32d9c789]
movsd dword es:[edi], dword [esi]
inc edx
cmp eax, 0xfdd0e3c8
mov edx, ebx
jnp 0x4b9cf0
je 0x4b9d09
int 0xd8
invalid
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor ecx, eax
dec esi
jne 0x4b9f43
mov dword [edx*4 + 0x579b20], ecx
inc edx
cmp edx, 0x100
jb 0x4b9f3e
mov esi, 0x800
jmp 0x4b9f8a
mov ecx, dword [edx*4 + 0x579720]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x579b20]
inc edx
mov dword [edx*4 + 0x579b1c], ecx
cmp edx, esi
jb 0x4b9f6e
mov dword [0x5788e8], fcn.004d6959
call fcn.004d73ce
mov ecx, dword [0x5788e8]
mov edx, 0x4d6c0d
test eax, eax
cmove ecx, edx
mov dword [0x5788e8], ecx
pop esi
ret

Function at 0x4c4bee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x27
ja 0x4c4dff
xchg edx, eax
sbb ecx, dword [edi]
jbe fcn.004c4bae
dec edi
pop ecx
xor ebx, esi
cmp ch, byte [esi - 0x56]
mov eax, dword [0x151b0028]
mov edx, 0x2b82ccbe
cmp byte [edi - 0x47], 0xd8
lds ecx, [edi + edi]
add byte [eax + 0x49], ah
mov dword [0xe2c6ec8], eax
or byte [ebx + 0x462e1c34], 4
ljmp 0xfea6
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
pop ebp
ret 0xc
Function at 0x4c6ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x54989f
call fcn.0054565c
push ecx
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 4], vtable.ICompressSetInStream.0
mov dword [esi + 8], vtable.ISequentialInStream.0
mov dword [esi + 0xc], vtable.ICompressSetOutStream.0
mov dword [esi + 0x10], vtable.ISequentialOutStream.0
mov dword [esi + 0x14], vtable.IOutStreamFlush.0
mov dword [esi + 0x18], vtable.ICompressSetCoderProperties.0
mov dword [esi + 0x1c], vtable.ICompressWriteCoderProperties.0
mov dword [esi + 0x20], vtable.ICryptoResetInitVector.0
mov dword [esi + 0x24], vtable.ICompressSetDecoderProperties2.0
mov dword [esi + 0x28], eax
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.5.0
mov dword [esi + 8], vtable.CFilterCoder.7.0
mov dword [esi + 0xc], vtable.CFilterCoder.9.0
mov dword [esi + 0x10], vtable.CFilterCoder.3.0
mov dword [esi + 0x14], vtable.CFilterCoder.2.0
mov dword [esi + 0x18], vtable.CFilterCoder.4.0
mov dword [esi + 0x1c], vtable.CFilterCoder.1.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.6.0
mov dword [ebp - 0x14], esi
into
push ebp
add bh, al
inc esi
and ah, cl
into
push ebp
add bh, al
inc esi
and al, 0x90
into
push ebp
add byte [ecx + 0x4689ec75], cl
xor byte [ecx + 0x4689fc45], cl
xor al, 0x89
inc esi
pop eax
jne 0x4c6b37
mov dword [esi + 0x30], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x41
ja 0x4c6d78
push ss
jg 0x4c6b49
jne 0x4c6baf
xchg edx, eax
mov al, byte [0x6f6d5712]
leave
pop es
sbb eax, 0x56353960
movsb byte es:[edi], byte [esi]
invalid
pushal
mov eax, 0xb79655b7
sbb al, 0x45
inc ebp
mov bl, 0xdb
jnp 0x4c6bc4
add edx, dword [ebp + 0xe]
test byte [eax], dh
xor eax, 0x37ab557c
aaa
pop ecx
dec edi
dec ebp
loopne 0x4c6bb6
sub dword [edi], edi
retf 0x7736
mov ecx, 0x20000
call fcn.004c4017
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x4c6d9e
push 0x564c58
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 1
call fcn.0041f140
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4c910b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 8
ja 0x4c9177
mov edx, 0xc2ef69bf
dec edx
sbb eax, 0xaec3d911
movsb byte es:[edi], byte [esi]
xchg ebx, eax
and edi, 0xffffffd4
mov ah, 0x4c
dec ebp
lahf
xchg ebp, eax
and dword [edi - 0x41a536bb], esp
stc
push edi
invalid
push dword [edi + 0x14]
push esi
call dword [esi + 4]
and dword [edi + 0x14], 0
pop ecx
pop ecx
pop edi
pop esi
ret
Function at 0x4cc163
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x13
ja 0x4cc377
les ebp, [ecx - 0x64]
or byte [eax + 0x4f], ch
mov ah, 0xab
add dh, byte [0x414a2c24]
xchg edx, eax
insd dword es:[edi], dx
and eax, 0xd3de1e18
inc ebx
cmp bh, bh
push 0xffffffffffffffd7
mov ah, 0x20
adc dword [ebp + 0x20], 0x6b
xor ecx, edi
push ebp
and eax, 0x314c4c3d
test dword [esi + 0x33], ebp
salc
enter 0xffffffffffffc052, 0xffffffffffffffc2
mov edi, dword [eax + 0x64514ec6]
push es
add edx, dword [ecx]
les eax, [edi + 0x5d]
out 0xd2, eax
test eax, 0x363c0ad0
or esi, edi
ret 0x76ba
mov edx, esi
mov ecx, edi
call fcn.004cb395
mov ecx, edi
pop edi
mov edx, esi
pop esi
jmp fcn.004c910b

Function at 0x4d1212
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5498fe
call fcn.0054565c
sub esp, 0xc
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x19
ja 0x4d1433
daa
push es
invalid
push esi
mov ecx, edi
call fcn.004dc0b6
cmp byte [eax], 0
jne 0x4d1445
mov eax, dword [ebp + 8]
jmp 0x4d14ab
push esi
mov ecx, edi
call fcn.004dc0b6
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push dword [eax + ecx*4 - 4]
lea ecx, [ebp - 0x18]
call fcn.0040eba9
xor esi, esi
mov dword [ebp - 4], esi
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_CharUpperW]
mov edi, 0x572f50
mov edx, dword [edi]
mov ecx, dword [ebp - 0x18]
call fcn.004c492a
test eax, eax
je 0x4d149d
inc esi
add edi, 8
cmp esi, 3
jb 0x4d1472
jne 0x4d1490
call int.004d41c2
push dword [ebp - 0x18]
call fcn.00418a9a
or eax, 0xffffffff
jmp 0x4d14aa
push dword [ebp - 0x18]
mov esi, dword [edi + 4]
call fcn.00418a9a
mov eax, esi
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret