joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd1b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x8005
push edi
call fcn.004bd358
add esp, 8
xor eax, eax
cmp eax, dword [ebp + 0x10]
jae 0x4bd1fb
movzx edx, bx
sar edx, 8
xor ecx, ecx
mov cl, byte [esi]
inc esi
xor edx, ecx
inc eax
shl ebx, 8
mov dx, word [edi + edx*4 + 0x30]
xor dx, bx
cmp eax, dword [ebp + 0x10]
mov ebx, edx
jb 0x4bd1db
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bd204
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4bd23f
mov eax, dword [ebp + 0x14]
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.0054e144
add esp, 0xc
xor eax, eax
jmp 0x4bd34f
push ebx
call fcn.0054d784
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0x581eda
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x4bd287
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0054e0d4
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push 0x581ef3
push ecx
call fcn.005518b4
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x4bd346
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, 0x581efc
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0054e1e8
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0054e1e8
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4bd339
cmp dword [ebp - 8], 0x32
jae 0x4bd339
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0054e0d4
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x4bd2b2
push edi
call fcn.0054d5bc
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d476c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d56a4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x58cfb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
call fcn.0054e578
mov dword [ebp - 0x158], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d5729
mov word [ebp - 0x20], 8
mov edx, 0x58ce1c
lea eax, [ebp - 4]
call fcn.0055c210
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0055c54c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.0055c51c
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4d57f8
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4d57a4
cmp esi, dword [ebp - 0x150]
jne 0x4d5793
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x134]
lea eax, [ebp - 8]
call fcn.0055c210
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.0055c54c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.0055c51c
pop eax
mov word [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4d57f8
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4d573a
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x20], 0x38
mov edx, 0x58ce23
lea eax, [ebp - 0xc]
call fcn.0055c210
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.0055c54c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x44
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.0055c51c
pop eax
mov word [ebp - 0x20], 0x38
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6e84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jne 0x4d6eaf
xor eax, eax
jmp 0x4d6fbf
lea edx, [ebp - 0x104]
push edx
push ebx
call fcn.004d6fc8
mov ecx, dword [ebp + 0xc]
add esp, 8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x30c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x30c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0054e278
pop ecx
dec eax
lea edx, [ebp + eax - 0x30c]
test eax, eax
jle 0x4d6f0e
movsx ecx, byte [edx]
cmp ecx, 0x5c
je 0x4d6f0e
dec eax
dec edx
test eax, eax
jg 0x4d6f00
mov byte [ebp + eax - 0x30c], 0
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.0054e371
add esp, 8
lea ecx, [ebp - 0x30c]
cmp eax, ecx
jne 0x4d6f3d
mov al, 1
jmp 0x4d6fbf
lea edi, [ebp - 0x208]
mov esi, 0x58d98b
mov eax, edi
lea edx, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0x208]
push ecx
call fcn.0054e1e8
add esp, 8
lea eax, [ebp - 0x30c]
lea edx, [ebp - 0x208]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d6f90
test cl, cl
je 0x4d6f8a
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d6f90
add eax, 2
add edx, 2
test cl, cl
jne 0x4d6f6e
jne 0x4d6f90
mov al, 1
jmp 0x4d6fbf
lea eax, [ebp - 0x30c]
mov edx, str._systemroot_system32
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d6fbd
test cl, cl
je 0x4d6fb7
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d6fbd
add eax, 2
add edx, 2
ret 0x8402
leave
jne 0x4d6f9b
jne 0x4d6fbd
mov al, 1
jmp 0x4d6fbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6ffc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x58d6e8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d6e84
add esp, 8
test al, al
jne 0x4d7035
xor eax, eax
jmp 0x4d70d0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054e278
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d705b
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d705b
dec ebx
dec eax
test ebx, ebx
jg 0x4d704d
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054e0d4
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d7098
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d708c
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054e378
add esp, 0xc
test eax, eax
je 0x4d70c5
inc ebx
cmp ebx, 7
jl 0x4d709a
cmp ebx, 7
jge 0x4d70ce
mov al, 1
jmp 0x4d70d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d70d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x58d774
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d6e84
add esp, 8
test al, al
jne 0x4d7111
xor eax, eax
jmp 0x4d71ac
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054e278
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d7137

Function at 0x4d71b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov esi, 0x58d800
lea edi, [ebp - 0x118]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054e278
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d71f8
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d71f8
dec ebx
dec eax
test ebx, ebx
jg 0x4d71ea
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054e0d4
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d7235
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d7229
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x118]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054e378
add esp, 0xc
test eax, eax
je 0x4d7262
inc ebx
cmp ebx, 1
jl 0x4d7237
dec ebx
jge 0x4d7269
mov al, 1
jmp 0x4d726b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7274
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4d7295
xor eax, eax
jmp 0x4d73a5
push ebx
call fcn.0054d784
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x4d72dd
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0054e0d4
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push str._04X_04X
push ecx
call fcn.005518b4
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x4d739c
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, str.StringFileInfo_
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0054e1e8
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0054e1e8
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4d738f
cmp dword [ebp - 8], 0x32
jae 0x4d738f
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0054e0d4
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x4d7308
push edi
call fcn.0054d5bc
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d73ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov esi, 0x58d814
lea edi, [ebp - 0x154]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, 0x58d864
lea edi, [ebp - 0x1b8]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004d6e84
add esp, 8
test al, al
jne 0x4d73f7
xor eax, eax
jmp 0x4d74e5
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054e278
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d741d
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d741d
dec ebx
dec eax
test ebx, ebx
jg 0x4d740f
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054e0d4
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d745a
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d744e
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x154]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054e378
add esp, 0xc
test eax, eax
je 0x4d7487
inc ebx
cmp ebx, 4
jl 0x4d745c
cmp ebx, 4
jge 0x4d74e3
push 2
lea eax, [ebp - 0x1b8]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d7274
add esp, 0x10
test al, al
jne 0x4d74ad
xor eax, eax
jmp 0x4d74e5
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x4d
jne 0x4d74c8
cmp byte [eax + 2], 0x63
jne 0x4d74c8
cmp byte [eax + 4], 0x6f
jne 0x4d74c8
mov al, 1
jmp 0x4d74e5
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x57
jne 0x4d74e3
cmp byte [eax + 1], 0x69
jne 0x4d74e3
cmp byte [eax + 2], 0x6e
jne 0x4d74e3
mov al, 1
jmp 0x4d74e5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
mov esi, 0x58d8c8
lea edi, [ebp - 0x118]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov esi, 0x58d8dc
lea edi, [ebp - 0x17c]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004d6e84
add esp, 8
test al, al
jne 0x4d764b
xor eax, eax
jmp 0x4d7737
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054e278
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d7671
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d7671
dec ebx
dec eax
test ebx, ebx
jg 0x4d7663
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054e0d4
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d76ae
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d76a2
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x118]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054e378
add esp, 0xc
test eax, eax
je 0x4d76db
inc ebx
cmp ebx, 1
jl 0x4d76b0
dec ebx
jge 0x4d7735
push 2
lea eax, [ebp - 0x17c]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d7274
add esp, 0x10
test al, al
jne 0x4d76ff
xor eax, eax
jmp 0x4d7737
lea eax, [ebp - 0x17c]
cmp byte [eax], 0x4d
jne 0x4d771a
cmp byte [eax + 2], 0x63
jne 0x4d771a
cmp byte [eax + 4], 0x6f
jne 0x4d771a
mov al, 1
jmp 0x4d7737
lea eax, [ebp - 0x17c]
cmp byte [eax], 0x57
jne 0x4d7735
cmp byte [eax + 1], 0x69
Function at 0x4dbd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
cmp byte [esi], 0xa0
jb 0x4dbd5a
cmp byte [esi + 1], 0xa0
jae 0x4dbd65
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
jmp 0x4dbf0c
mov eax, ebx
call fcn.00509898
cmp al, 5
jne 0x4dbf0c
mov eax, ebx
mov dword [ebp - 0x20], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x20]
add eax, 3
test eax, eax
jns 0x4dbd8f
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x24], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
dec edx
call fcn.0050991c
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x4dbf0c
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jge 0x4dbf0c
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dbf0c
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x4dbf0c
push 2
push esi
lea eax, [ebp - 6]
push eax
call fcn.0054e0d4
add byte [ebp - 6], 0x60
add byte [ebp - 5], 0x60
xor edx, edx
xor eax, eax
mov dl, byte [ebp - 6]
mov al, byte [ebp - 5]
add esp, 0xc
lea ecx, [edx + edx*2]
shl ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, eax
mov eax, ecx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xfffff718
test eax, eax
jb 0x4dbe39
cmp eax, 0x2feb0
jb 0x4dbe44
mov edx, dword [ebp + 0x10]
add dword [edx], 0xc
jmp 0x4dbf0c
push 0x18
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0054e0d4
add esp, 0xc
lea edx, [ebp - 0x40]
xor eax, eax
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0x18
jl 0x4dbe5d
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dbd08
pop ecx
xor edx, edx
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dbef8
cmp eax, dword [ebp - 0x18]
jge 0x4dbef8
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x20]
mov bx, word [eax]
mov cx, 1
mov eax, ebx
movzx ebx, bx
sar ebx, 8
shl eax, 8
or ax, bx
mov ebx, eax
mov eax, dword [ebp - 0x18]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x24]
add eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
xor eax, eax
mov esi, 0xf
sub esi, eax
add esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x1c]
jge 0x4dbef0
cmp eax, 4
jl 0x4dbef0
test cx, bx
jbe 0x4dbef0
mov esi, 0xf
sub esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*2]
mov si, word [ebp - 0xe]
mov word [edi], si
add ecx, ecx
inc eax
cmp eax, 0x10
jl 0x4dbec3
inc edx
add dword [ebp - 0x28], 2
cmp edx, 0xc
jl 0x4dbe7d
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dbf14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
cmp bl, 0x20
jb 0x4dbf2d
cmp bl, 0x7f
jb 0x4dbf38
mov eax, dword [ebp + 0x10]
add dword [eax], 6
jmp 0x4dc09b
mov eax, esi
call fcn.00509898
cmp al, 5
jne 0x4dc09b
mov eax, esi
mov dword [ebp - 0x1c], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x1c]
add eax, 3
test eax, eax
jns 0x4dbf62
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x20], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, esi
dec edx
call fcn.0050991c
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff4
jle 0x4dc09b
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jge 0x4dc09b
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dc09b
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x14]
jge 0x4dc09b
xor eax, eax
mov al, bl
shl eax, 2
lea eax, [eax + eax*2]
add eax, 0xfffffe80
test eax, eax
jb 0x4dbfe1
cmp eax, 0x474
jb 0x4dbfec
mov edx, dword [ebp + 0x10]
add dword [edx], 6
jmp 0x4dc09b
push 0xc
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x30]
push eax
call fcn.0054e0d4
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x30]
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0xc
jl 0x4dc005
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dbd08
pop ecx
xor edx, edx
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dc08c
cmp eax, dword [ebp - 0x14]
jge 0x4dc08c
mov cl, 1
mov eax, dword [ebp - 0x14]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
imul ebx, dword [ebp - 0x1c]
add eax, ebx
mov dword [ebp - 8], eax
xor eax, eax
mov ebx, dword [ebp - 0x24]
mov esi, ebx
mov ebx, 8
sub ebx, eax
add ebx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 0x18]
jge 0x4dc084
cmp eax, 2
jl 0x4dc084
test byte [esi], cl
jbe 0x4dc084
mov ebx, 8
sub ebx, eax
mov edi, dword [ebp - 8]
lea edi, [edi + ebx*2]
mov bx, word [ebp - 0xa]
mov word [edi], bx
add ecx, ecx
inc eax
cmp eax, 8
jl 0x4dc058
inc edx
inc dword [ebp - 0x24]
cmp edx, 0xc
jl 0x4dc025
mov eax, dword [ebp + 0x10]
add dword [eax], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dc200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.004dc18c
mov eax, dword [ebp + 8]
add eax, esi
jmp 0x4dc238
mov edx, ebx
shr edx, 0x18
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov edx, dword [ecx*4 + 0x5a8d2c]
mov cl, byte [eax]
shl ebx, 8
and ecx, 0xff
or ebx, ecx
xor ebx, edx
inc eax
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x4dc215
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4e216c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx + 0x104], edi
test edi, edi
jne 0x4e2199
push 0x3e8
call sub.KERNEL32.DLL_Sleep
inc esi
cmp esi, 5
jl 0x4e2177
cmp esi, 5
jl 0x4e21a6
or eax, 0xffffffff
jmp 0x4e228d
push str.Create
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x598650], eax
push str.Start
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x598654], eax
push str.Stop
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x598658], eax
push str.Addbuffer
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x598660], eax
push str.Getnowtimehm
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59865c], eax
push str.Setylvalue
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x598664], esi
cmp dword [0x598650], 0
jne 0x4e223d
mov eax, 0xfffffffe
jmp 0x4e228d
cmp dword [0x598654], 0
jne 0x4e224d
mov eax, 0xfffffffd
jmp 0x4e228d
cmp dword [0x598658], 0
jne 0x4e225d
mov eax, 0xfffffffc
jmp 0x4e228d
cmp dword [0x598660], 0
jne 0x4e226d
mov eax, 0xfffffffb
jmp 0x4e228d
cmp dword [0x59865c], 0
jne 0x4e227d
mov eax, 0xfffffffa
jmp 0x4e228d
test esi, esi
jne 0x4e2288
mov eax, 0xfffffff9
jmp 0x4e228d
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret