joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5190
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4c51fb
cmp byte [ebx + 0xd3], 0
jne 0x4c51fb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00407398
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4c51e8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4c5208
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040725c
jmp 0x4c5208
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040725c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4c6a30
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c6a9e
mov eax, esi
call fcn.0049f028
test al, al
je 0x4c6a9e
mov eax, dword [ebx + 0x84]
call fcn.0049ec7c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c6a9e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4c6a92
push 0
mov eax, dword [ebx + 0x84]
call fcn.0049ec7c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00495c1c
jmp 0x4c6a9e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004c6868
pop esi
pop ebx
ret

Function at 0x4cae84
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, eax
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, ebx
call fcn.004072e8
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4caef3
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.00416338
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d25b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4d26e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov esi, 1
test edx, edx
je 0x4d25f6
inc esi
push 0xbf
push edi
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_MsgWaitForMultipleObjects
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d261e
call sub.wsock32.dll_WSAGetLastError
call fcn.004ce628
jmp 0x4d26bf
cmp ebx, 0x102
jne 0x4d2640
lea edx, [ebp - 0x30]
mov eax, dword [0x562ef8]
call fcn.0040a5a0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004ce680
jmp 0x4d26bf
cmp ebx, esi
jne 0x4d26bf
jmp 0x4d2681
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageW
cmp edi, 0xffffffff
je 0x4d2681
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x4d2681
lea edx, [ebp - 0x34]
mov eax, dword [0x562ef8]
call fcn.0040a5a0
mov eax, dword [ebp - 0x34]
or edx, 0xffffffff
call fcn.004ce680
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x4d2646
cmp edi, 0xffffffff
je 0x4d26bf
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x4d26bf
lea edx, [ebp - 0x38]
mov eax, dword [0x562ef8]
call fcn.0040a5a0
mov eax, dword [ebp - 0x38]
or edx, 0xffffffff
call fcn.004ce680
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d26e8
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00407254
ret

Function at 0x4d3240
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push esi
push ecx
push edx
call sub.wsock32.dll_recv
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004d350c
cmp dword [eax + 0xc], 0
jle 0x4d32c4
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d32bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004d350c
push dword [eax + 0xc]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
imul eax, eax, 0x3e8
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, eax
mov eax, ebx
call fcn.004d3490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d32c4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetLastError
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4d3368
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push esi
push ecx
push edx
call sub.wsock32.dll_send
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004d350c
cmp dword [eax + 0xc], 0
jle 0x4d33ec
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d33e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004d350c
push dword [eax + 0xc]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
imul eax, eax, 0x3e8
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, eax
mov eax, ebx
call fcn.004d3490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d33ec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetLastError
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4d3490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, edx
lea edi, [esp + 4]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0xbf
push ebx
push 0
lea eax, [esp + 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub eax, 1
jb 0x4d3503
je 0x4d34e4
sub eax, 0x101
jne 0x4d34a9
jmp 0x4d3503
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageW
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x4d34f6
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x4d34cd
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x4d3503
jmp 0x4d34a9
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x4df5d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov eax, edi
xor edx, edx
call fcn.0040725c
push 0
push 0
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.004d8fac
mov esi, eax
cmp esi, 1
jl 0x4df66f
mov ecx, esi
mov dl, 1
mov eax, dword [0x4d9454]
call fcn.004c9c44
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4df668
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.004d8fac
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004c9f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df66f
mov eax, dword [ebp - 4]
call fcn.00405480
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f023c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4f0244
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f03ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x4f0404
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x38]
call fcn.0040725c
lea ecx, [ebp - 0xc]
mov edx, 0x4f0424
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.0040725c
lea ecx, [ebp - 0x10]
mov edx, 0x4f0440
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x18]
call fcn.0040725c
lea ecx, [ebp - 0x14]
mov edx, 0x4f045c
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.0040725c
lea ecx, [ebp - 0x18]
mov edx, 0x4f0478
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x1c]
call fcn.0040725c
lea ecx, [ebp - 0x1c]
mov edx, 0x4f0494
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x1c]
mov eax, 0x4f04b0
call fcn.0041309c
mov byte [ebx + 4], al
lea ecx, [ebp - 0x20]
mov edx, 0x4f04c8
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call fcn.0040725c
lea ecx, [ebp - 0x24]
mov edx, 0x4f04ec
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x10]
call fcn.0040725c
lea ecx, [ebp - 0x28]
mov edx, 0x4f0504
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x24]
call fcn.0040725c
lea ecx, [ebp - 0x2c]
mov edx, 0x4f0524
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x30]
call fcn.0040725c
lea ecx, [ebp - 0x30]
mov edx, 0x4f053c
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x28]
call fcn.0040725c
lea ecx, [ebp - 4]
mov edx, 0x4f0558
mov eax, esi
call fcn.004ca1e0
cmp dword [ebp - 4], 0
je 0x4f03a8
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4f056c
call fcn.00407740
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00413ee4
mov dword [ebx + 0x20], eax
lea ecx, [ebp - 0x34]
mov edx, 0x4f057c
mov eax, esi
call fcn.004ca1e0
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x2c]
call fcn.0040725c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f03f1
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00407254
ret
Function at 0x516b54
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x516c64
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.00516a78
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
mov eax, dword [esi + 0x18]
push eax
call fcn.004c8d74
test eax, eax
je 0x516c26
mov eax, ebx
call fcn.0051640c
mov eax, ebx
call fcn.00517928
mov edx, dword [ebp - 4]
call fcn.004ccf60
mov eax, ebx
call fcn.00517928
cmp dword [eax + 0x24], 0x190
jl 0x516c41
mov eax, ebx
call fcn.00517928
mov eax, dword [eax + 0x24]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x5631cc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x14]
push eax
mov eax, ebx
call fcn.00517928
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
pop eax
call fcn.00415038
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4cc6a4]
call fcn.004ccfe4
call fcn.00405f58
jmp 0x516c41
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5630f8]
call fcn.0040a5a0
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, ebx
call fcn.0051633c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516c6b
lea eax, [ebp - 0x20]
call fcn.0040724c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407254
ret
Function at 0x521000
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x52102e
mov eax, ebx
call fcn.00521ab4
cmp dword [ebx + 0x40], 0
je 0x521027
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x52109f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x521091
cmp dword [ebx + 8], 0
je 0x521050
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x521062
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x521091
cmp dword [ebx + 8], 0
je 0x521043
cmp eax, 3
je 0x521075
dec eax
jne 0x521043
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x521043
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x521043
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5210bd
cmp dword [ebx + 0x14], 0xcc
je 0x5210bd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005210c8
pop ebx
ret

Function at 0x535d5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x535d74
add esp, 0xfffffff0
call fcn.004059b4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x535e8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404244
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x535e78
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00531b2c
xor eax, eax
push ebp
push 0x535e65
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00531b2c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004074d4
jmp 0x535e36
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407a7c
mov eax, dword [ebx + 4]
call fcn.004075dc
dec eax
jle 0x535e4a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x535e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535e6c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535e95
lea eax, [ebp - 4]
call fcn.00406eb4
ret
Function at 0x53ba64
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov esi, eax
mov eax, dword [esi + 0x38]
call fcn.00436e00
test eax, eax
setg bl
test bl, bl
je 0x53bb15
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [esi + 0x5c]
call fcn.004072e8
push eax
call sub.kernel32.dll_CreateFileW_1
mov edi, eax
cmp edi, 0xffffffff
setne bl
test bl, bl
je 0x53bb15
mov eax, esi
call fcn.0053c2e8
cmp edx, 0
jne 0x53bac0
cmp eax, 0
jbe 0x53bb0f
jmp 0x53bac2
jle 0x53bb0f
xor eax, eax
mov dword [esp], eax
push esp
push edi
call sub.kernel32.dll_GetFileSize_1
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
xor eax, eax
or eax, dword [esp + 8]
or edx, dword [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, esi
call fcn.0053c2e8
cmp edx, dword [esp + 0xc]
jne 0x53bb0c
cmp eax, dword [esp + 8]
sete bl
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x5417fc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5694d0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x54181e
shr eax, 1
xor eax, 0xedb88320
jmp 0x541820
shr eax, 1
dec edx
jne 0x54180c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x541805
mov byte [0x5698d0], 1
pop esi
pop ebx
ret

Function at 0x54183c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5698d0], 0
jne 0x541853
call fcn.005417fc
mov eax, edi
dec eax
test eax, eax
jl 0x54187b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5694d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x54185d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x544624
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5446be.0
jmp dword [ecx*4 + 0x544657]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x544689
sub dl, 8
je 0x544698
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5442cc
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x544324
jmp case.0x5446be.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5446be.0
movzx ecx, byte [ecx + 0x5446c5]
jmp dword [ecx*4 + 0x5446d6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5443d0
jmp case.0x5446be.0
cmp dl, 3
jne 0x544703
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x544428
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5443e4
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x54446c
jmp case.0x5446be.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x54472e
sub dl, 8
je 0x54473a
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x544498
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x544504
jmp case.0x5446be.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x544759
sub dl, 8
je 0x544765
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5445c0
jmp case.0x5446be.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5445e8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x544807
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005437d0
test eax, eax
je 0x544807
mov eax, ebx
call fcn.00544810
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x5447a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x544810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x544841
dec al
je 0x54487c
dec al
je 0x5448c1
dec al
je 0x54492a
jmp 0x5449b4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5449b4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x544851
jmp 0x5449b4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5449b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x54488c
jmp 0x5449b4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5449b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5448f0
xor ebp, ebp
jmp 0x544900
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x544909
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5448d1
jmp 0x5449b4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5449b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x544983
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00541884
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x54493e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret