joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47af98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47afc6
mov eax, ebx
call fcn.0047ba50
cmp dword [ebx + 0x3c], 0
je 0x47afbf
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47b037
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x47b029
cmp dword [ebx + 8], 0
je 0x47afe8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x47affa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47b029
cmp dword [ebx + 8], 0
je 0x47afdb
cmp eax, 3
je 0x47b00d
dec eax
jne 0x47afdb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47afdb
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x47afdb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47b055
cmp dword [ebx + 0x10], 0xcc
je 0x47b055
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047b060
pop ebx
ret

Function at 0x48b188
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d54
mov eax, dword [ebp - 8]
call fcn.00404d54
xor eax, eax
push ebp
push 0x48b2a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00404d64
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x48b2b4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404d64
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48b28a
xor eax, eax
push ebp
push 0x48b283
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x48b263
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48b267
xor eax, eax
jmp 0x48b269
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b28a
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b2ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048d8
ret
Function at 0x48b2bc
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d54
mov eax, dword [ebp - 8]
call fcn.00404d54
mov eax, dword [ebp - 0xc]
call fcn.00404d54
mov eax, dword [ebp + 0xc]
call fcn.00404d54
xor eax, eax
push ebp
push 0x48b42b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404d64
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x48b43c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404d64
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48b408
xor edx, edx
push ebp
push 0x48b401
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404d64
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404d64
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d64
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x48b3ea
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x48b3e1
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48b3e5
xor eax, eax
jmp 0x48b3e7
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b408
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b432
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048d8
lea eax, [ebp + 0xc]
call fcn.004048b4
ret
Function at 0x48b444
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x48b50c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x48b510
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x48b50c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48b503
xor eax, eax
push ebp
push 0x48b4fc
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b503
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ca50
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff4
mov bl, 2
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.004032cc
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x48ca87
cmp byte [esp], 0x31
jne 0x48ca85
mov bl, 1
jmp 0x48ca87
xor ebx, ebx
mov eax, ebx
add esp, 0xc
pop ebx
ret
Function at 0x497434
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49750c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x549da0], 0
jne 0x4974f0
lea eax, [ebp - 4]
mov edx, 0x497524
call fcn.0040494c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d64
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4974f0
mov eax, ebx
call fcn.004027d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4974e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4974d3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x497534
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4974d3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x549da0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4974f0
mov eax, dword [ebp - 0xc]
call fcn.004027f8
ret
mov ebx, dword [0x549da0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497513
lea eax, [ebp - 4]
call fcn.004048b4
ret

Function at 0x49fe7c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x49feb4]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49fe92
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49fea1
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49feb0
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4a11c4
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x547f9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a11ea
push 0
mov eax, dword [0x547f9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4bcb9c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bcd0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bcce8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a94
lea eax, [ebp - 0x118]
mov edx, 0x4bcd24
call fcn.00404b74
mov eax, dword [ebp - 0x118]
call fcn.00404d64
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4bcc5a
lea eax, [ebp - 0x111]
call fcn.0040a250
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004049a4
jmp 0x4bcc61
mov eax, esi
call fcn.004048b4
cmp bl, 0x61
jae 0x4bcc82
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e334
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404908
jmp 0x4bcc9c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e2a8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404908
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4bcd30
call fcn.0040a9ec
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bccef
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c0b74
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d54
xor eax, eax
push ebp
push 0x4c0c7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004048b4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d64
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x4c0c65
mov eax, ebx
call fcn.004027d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c0c5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c0c8c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov ebx, dword [ebp - 0x10]
push esi
mov eax, dword [ebx + 8]
call fcn.00407e28
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
mov eax, dword [ebx + 0xc]
call fcn.00407e28
movzx eax, ax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
movzx eax, word [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x30]
mov ecx, 3
mov eax, 0x4c0c98
call fcn.0040a9ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0c65
mov eax, dword [ebp - 0xc]
call fcn.004027f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0c82
lea eax, [ebp - 4]
call fcn.004048b4
ret
Function at 0x4c153c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c1684
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov eax, ebx
call fcn.0040a0d0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004090d8
mov edx, dword [ebp - 0x48]
mov eax, 0x4c16a0
call fcn.00404ea8
test eax, eax
jle 0x4c160c
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.0040a098
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
call fcn.004c010c
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 8]
pop ecx
call fcn.00404bb8
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, esi
call fcn.004c01a0
push 5
push 0x4c16a4
lea eax, [ebp - 0x58]
call fcn.004c010c
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 8]
call fcn.0040a098
mov edx, dword [ebp - 0x5c]
pop eax
call fcn.00404b74
mov eax, dword [ebp - 0x58]
call fcn.00404d64
push eax
push 0x4c16a8
push 0x4c16b8
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x4c1661
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov eax, ebx
call fcn.00404d64
mov dword [ebp - 0x34], eax
mov eax, 0x4c16b8
mov dword [ebp - 0x38], eax
mov eax, edi
call fcn.00404d64
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
call fcn.00404d64
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x440
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c168b
lea eax, [ebp - 0x5c]
mov edx, 6
call fcn.004048d8
lea eax, [ebp - 8]
call fcn.004048b4
ret

Function at 0x4c4ae0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x4c4afe
and ecx, ecx
jle 0x4c4afe
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x4c4ae9
pop ebx
ret

Function at 0x4c4b44
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x4c4b69
and ecx, ecx
jle 0x4c4b69
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x4c4b6b]
mov bl, byte [edx]
xor bl, al
shr ax, 8
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x4c4b57
pop edi
pop ebx
ret

Function at 0x4c4d6c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x4c4d8f
and ecx, ecx
jle 0x4c4d8f
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x4c4d95]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x4c4d7f
pop edi
pop ebx
ret
Function at 0x4d1308
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call fcn.00402b24
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x4d13ed
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x530a54
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x529548]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x4d134e
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x4d13b8
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x4d134c
inc dword [esp]
dec dword [esp + 8]
jne 0x4d133b
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x4d13ef
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d59c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x548188]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x548188]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.004d5990
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.004d5990
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.004d5990
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.004d5990
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x4d5a0e
movzx edx, word [ebx]
mov eax, edi
call fcn.004d5990
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x548188]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.004d5990
mov word [ebp - 4], ax
mov ebx, dword [0x548188]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d6134
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x4d6157
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d7aec
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4d7b02
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4d7afb
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x4d7b8d
movzx ecx, byte [ecx + 0x533bb0]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x533ab0]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x533ab0]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x533bb0]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x4d7bea
movzx ecx, byte [ecx + 0x533bb0]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x533bb0]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x533ab0]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x533ab0]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x533ab0]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x533bb0]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x533ab0]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x533bb0]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x533ab0]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x533ab0]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x533bb0]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x533bb0]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x533cb0]
xor edx, dword [ebx*4 + 0x5340b0]
xor edx, dword [eax*4 + 0x5344b0]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x5348b0]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4d7dec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x4d7dfc
pop esi
pop ebx
ret
Function at 0x4d7e10
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x533ab0
lea eax, [ebp - 0x100]
call fcn.004d7dec
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x533ab0]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x533cb0]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4d7e41
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x533bb0
lea eax, [ebp - 0x100]
call fcn.004d7dec
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x533ab0]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x5340b0]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4d7e90
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x533ab0
lea eax, [ebp - 0x100]
call fcn.004d7dec
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x533bb0]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x5344b0]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4d7ee3
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x533bb0
lea eax, [ebp - 0x100]
call fcn.004d7dec
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x533bb0]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x5348b0]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4d7f36
pop esi
pop ebx
mov esp, ebp
pop ebp
ret