joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aff78
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4aff8a
add esp, 0xfffffff0
call fcn.0040454c
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.00405c84
xor eax, eax
push ebp
push 0x4b0036
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.004041f8
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.00405918
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
movzx eax, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x4accac]
call fcn.004066c8
add esp, 4
mov eax, edi
call fcn.004afdcc
test al, al
jne 0x4b0020
call fcn.0040dd24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b003d
lea eax, [ebp + 0x1c]
call fcn.004058dc
ret

Function at 0x4b6460
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4e8558]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4b6498
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4b64b0
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b64a9
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403a24
xor edx, edx
mov eax, 0x4e8758
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4b6517
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4b64ce
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6758
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b6771
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b676a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b6783
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b677c
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b6350
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b679d
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004b6460
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b6825
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b6843
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b63e0
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b686d
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b6884
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b689d
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b6896
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b68b1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6250
test bl, bl
jne 0x4b698b
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4f194c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b68e9
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b68fe
push 0x63
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6758
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b6931
add dword [ebp - 0x14], 0x64
dec dword [ebp - 8]
jne 0x4b68de
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b6955
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b6967
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b697c
jmp 0x4b6a4c
cmp bl, 1
jne 0x4b6a4c
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4f1f28
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b69ab
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b69c0
push 0x63
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6758
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b69f3
sub ebx, 0x64
inc dword [ebp - 8]
jne 0x4b69a0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b6a1b
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b6a2d
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b6a42
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b62d0
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc7c0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4bc85a
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x4e88ec]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x4e88ec]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x4e88ec]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x4e88ec]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4bc7df
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4bc870
dec edx
je 0x4bc8a5
jmp 0x4bc8f6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4e88ec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x4e88ec]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4bc8f6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4e88ec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x4e88ec]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x4e88ec]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4bee90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4beeba
mov ecx, 0x4bef1c
mov dl, 1
mov eax, dword [0x4be24c]
call fcn.0040dd50
call fcn.00404a9c
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4bef09
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403170
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4beeca
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bef34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4bef5e
mov ecx, 0x4befc8
mov dl, 1
mov eax, dword [0x4be24c]
call fcn.0040dd50
call fcn.00404a9c
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4befb6
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403170
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4bef70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bf584
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bf606
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4be578]
mov eax, 0x14
call fcn.004060e4
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040996c
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.0040517c
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4f1fa0]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4f1fa0], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf60d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040514c
ret

Function at 0x4bf614
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4bf690
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4be5a0]
mov eax, 0x10
call fcn.004060e4
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040996c
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.0040517c
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x4f1fa4]
mov dword [ebx], eax
mov dword [0x4f1fa4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf697
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040514c
ret

Function at 0x4bf6ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4bf70d
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bf6fa
pop edi
pop esi
pop ebx
ret
Function at 0x4d1bfc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d1d74
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004d1f00
mov esi, eax
test esi, esi
je 0x4d1c5a
inc dword [ebp - 0x14]
test ebx, ebx
jne 0x4d1c5a
mov eax, dword [edi + 0x38]
mov eax, dword [eax + 0x38]
mov edx, esi
call fcn.00421790
cmp dword [ebp - 0x18], 0
jle 0x4d1cb5
mov dword [ebp - 0x10], esi
inc ebx
mov eax, dword [ebp - 4]
call fcn.0040650c
cmp ebx, eax
jl 0x4d1ca4
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4d1bb4]
call fcn.004066c8
add esp, 4
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4d1bd8]
call fcn.004066c8
add esp, 4
mov eax, dword [ebp - 8]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + ebx*4], edx
jmp 0x4d1ced
test ebx, ebx
jle 0x4d1ced
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
jmp 0x4d1ccc
dec ebx
test ebx, ebx
jle 0x4d1ccc
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4], 0
jne 0x4d1cd9
test ebx, ebx
jg 0x4d1cc1
test ebx, ebx
jne 0x4d1ce4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4d1ced
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x64
cdq
idiv ecx
test edx, edx
jne 0x4d1d0e
mov eax, dword [ebp - 0xc]
call fcn.0041bb74
push edx
push eax
mov eax, dword [edi + 0x38]
call fcn.004ccf70
test esi, esi
jne 0x4d1c2f
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x4d1d8c
call fcn.0040b0d4
mov eax, dword [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, edi
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1d7b
lea eax, [ebp - 0x1c]
call fcn.00405128
lea eax, [ebp - 8]
mov edx, dword [0x4d1bd8]
call fcn.004067c8
lea eax, [ebp - 4]
mov edx, dword [0x4d1bb4]
call fcn.004067c8
ret

Function at 0x4dba34
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
or ecx, 0xffffffff
dec edx
test edx, edx
jb 0x4dba60
inc edx
xor ebx, ebx
mov esi, ecx
shr esi, 8
mov edi, eax
add edi, ebx
xor ecx, dword [edi]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4ea120]
mov ecx, esi
inc ebx
dec edx
jne 0x4dba42
mov eax, ecx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x4dcb28
Capabilities:
Encode data using xor

Disassembly:
push ebx
test eax, eax
je 0x4dcb51
test edx, edx
je 0x4dcb51
dec ecx
test ecx, ecx
jb 0x4dcb51
inc ecx
movzx ebx, byte [eax]
xor bl, 0x9e
movzx ebx, bl
movzx ebx, byte [ebx + 0x4ea520]
xor bl, 0x34
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x4dcb37
pop ebx
ret

Function at 0x4fd960
Capabilities:
Packed with generic packer

Disassembly:
push ebp
lea esp, [esp + 0x24]
jmp fcn.004ba302
jg 0x5154e2
nop
call fcn.0055cecc
push 0x5c39e216
pushal
mov dword [esp + 0x20], 0xb3601e56
call fcn.0055fd1e
add eax, 0xb6e1ba04
jne 0x4fd956
push ss
dec ebx
pop ds
pop es
invalid
call fcn.0052f9ec

Function at 0x50a856
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push cs
sub byte [ebx], ah
sti
invalid
pushal
bswap cx
not cx
movsx ecx, cl
nop
call fcn.005399b2
and ecx, esi
jne 0x50a815
xchg edx, eax
invalid

Function at 0x51c9ff
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + 0x3be38]
pushfd
pushfd
jmp 0x51ef90
lea edx, [edx + 0x8ca8730]
call fcn.0052741f
mov dword [esp + 4], 0xb33cd496
jmp 0x55dd78
sti
call [eax + ebp*8 - 0x3e0b3]
call fcn.00533005
push esp
fild dword [ebx + 0x22bbe4be]
jne 0x55dd13
mov esi, 0x7522bbe4
invalid
aad 0xc8
aad 0xc6
jecxz 0x55dd94
mov si, 0x1abf
add ecx, dword [eax]
push 0xffffffffffffffb7
pop eax
mov bh, 0x65
pop eax
sbb dword [edi - 0x29], 0x67faaeac
add ecx, dword [ecx]
lodsb al, byte [esi]
scasb al, byte es:[edi]
cli
add ecx, dword [bx + di]
fadd dword [ebx]
imul byte [edx]
fsubr st(7), st(0)
xchg edx, eax
xor dword [esi], ecx
push ds
jo 0x55dd9a
fst qword [edi + edx*2 - 0x2447a98]
inc edi
cdq
adc byte [0xd06d97af], 9
aaa
mov dh, 0x71
or esi, ebx
aam 0xe7
push 0x2404c79c
salc
push esi
jo 0x55dd80
pushfd
jmp 0x53da97

Function at 0x51d239
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 8]
mov eax, dword [eax + 0x951bd]
call fcn.005112a0
jmp 0x4fa58a
movsx ax, bl
lahf
nop
not eax
movsx ax, bl
pop eax
jo 0x531afd
xchg dword [esp], eax
pushal
mov dword [esp + 0x1c], eax
pop eax
mov eax, 0x4a7e69
pushfd
jmp 0x5130f0
pushfd
call fcn.0052368d
mov al, 0x40
cmp bh, byte [ebp - 0x7ca7a27b]
aaa
invalid

Function at 0x52a1e9
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp]
pushfd
mov byte [esp], dl
mov edi, dword [edi + 0xd4956]
push ebp
jmp 0x52b1fa
lea esp, [esp + 8]
jae 0x52ad59
push edi
call fcn.00517620
popal
add byte [esi - 0x29089991], dl
not si
jmp 0x551e68
lea edi, [edi + 0x16cede3a]
mov byte [esp + 4], bh
call fcn.0050e9b2
push 0x11277ae
pushfd
xchg dword [esp + 4], edi
not di
mov edi, 0x47650a
jmp 0x51b25e

Function at 0x536805
Capabilities:
Packed with generic packer

Disassembly:
bswap eax
mov eax, dword [esp + 4]
pushal
call fcn.0052d10c

Function at 0x53cc50
Capabilities:
Packed with generic packer

Disassembly:
call 0x520df0
jmp 0x54fdd0
nop
mov byte [esp], 0x34
mov byte [esp], 0xc
pushal
push dword [esp]
xchg dword [esp + 0x44], edi
lea edi, [edx + 0x6a0b542d]
not di
mov edi, 0x498956
call fcn.00520127
jmp 0x5193e7
Function at 0x53d87f
Capabilities:
Encode data using xor

Disassembly:
movzx dx, bl
mov edx, 0x41183e
sbb byte [ecx], al
call fcn.0051c5cf
sbb byte [ebx + 7], dh
cdq
out 0x79, eax
or eax, 0x4bb76fd7
pop ds
call 0xb5e1ad17
lcall 0x7cf5, 0xe250c3c6
xor ebx, dword [eax]
sub edx, dword [ebx]
xor al, 0
loop 0x4fe438
cdq
sar byte [ebx], 0x5c
xor byte [ecx + edi*8 + 0x3c], ah
mov ah, 0xcf
int 0x7a
iretd
lea edx, [ecx*8 + 0x4f291658]
lea esp, [esp + 0x30]
jg 0x54d7b0
mov edx, 0x41183e
call fcn.005102d6
mov dl, cl
mov dl, 0x8a
xor byte [edi], ch
adc ebp, eax
lahf
call 0x7027ff5b
lea esi, [ecx + 0x5a2c1f2a]
int1
jmp 0xcfa48e21
mov dword [esp + 0x30], edx
jmp 0x51b142
mov byte [esp], 0xab
jmp 0x51e0c5
lea edx, [esi + 0x41aea637]
jmp 0x4fe432

Function at 0x53db7e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg dword [esp + 0x28], edx
lea edx, [esp + 0x6d77d6e9]
xchg esp, eax
and al, 0xe9
salc
ja 0x4fc8b9
pushfd
jmp 0x4fc841

Function at 0x53e470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x54338c
jmp 0x551e8c
mov byte [esp], bl
push dword [esp + 8]
mov edi, dword [edi + 0x1048dc]
lea esp, [esp + 0x10]
jle 0x4fcf13
and al, 0xff
je 0x5231b7
or byte [ebx + 0x1048dcbf], cl
add byte [ebp + 0xf102464], cl
mov gs, word [edi - 0x63]
std
call [ebx + edx*2 - 0x18407264]
mov eax, dword [0x44c62b1a]
and al, 4
cmp eax, 0xfe6fafe8
inc esp
cmp dword [0xd72e61b], eax
pushfd
push ebx
pushfd
lea edi, [edi + 0x2b1aa1e7]
mov byte [esp + 4], 0x3d
call fcn.0050a166
les edi, [ecx]
add eax, 0xd72e61b
mov bl, 0xaf
mov ah, 0xae
test edi, 0x8803f968
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
mov dl, 0xd3
inc esi
mov esi, 0xcbc69dbf
sub byte [ebp - 0x462e39e8], al
fcompi st(0)
insb byte es:[edi], dx
push ebp
dec edi
test byte [esi - 0x4f], 0x4f
xchg ebx, eax
xchg ecx, edi
jl 0x52318f
mov dh, byte [ecx + 6]
xor eax, dword [eax]
retf
pushfd
jmp 0x521d27
lea edi, [edi + 0x2b1aa1e7]
call fcn.0052f215
nop
push eax
pushfd
mov dword [esp + 8], edi
movzx di, cl
push 0xb563c763
bswap di
not di
mov edi, 0x430ac5
jmp 0x52318d

Function at 0x545dea
Capabilities:
Packed with generic packer

Disassembly:
mov esi, 0x45bd24
pushal
mov dword [esp + 0xc], ebx
call fcn.0055a2d7
Function at 0x549ac6
Capabilities:
Packed with generic packer

Disassembly:
mov esi, 0x45e308
jmp 0x54af17
pushfd
pushal
mov word [esp + 0x1c], 0x52a
pushal
nop
pushfd
jmp 0x55f931
pushfd
xchg dword [esp + 8], eax
inc esp
and al, 8
mov byte [esp], cl
push dword [esp + 4]
push 0xe0ad556f
push dword [esp + 0x10]
ret 0x18
call fcn.00509dcc
outsd dx, dword [esi]
rcl dword [esi], 0xf9
mov byte [0x39187692], al
sub dword [edi + 0x71], ecx
imul esi, dword [ecx], 0x4f
mov ah, 0x2c
mov cl, 0xcb
push ebp
popal
clc
pop edx
xchg dword [ebx], ebx
sub edi, esp
adc bh, bl
in al, dx
dec ebp
loop 0x54afa4
jp 0x54aeff
cmp dword [edi + ecx], 0x802de04d
cmp edi, eax
ficomp dword [eax + 0x40]
sbb dl, byte [ecx - 0x2bb79cfe]
js 0x54af01
lcall 0x5930, 0xba0f6cb
wait
pop es
adc eax, 0x7ad5e0c4
add bl, byte [esi]
add dword [edx + 0x7fde002d], esi
mov dword [0xf6248834], eax
adc dword [edi], 0xffffffbc
add byte [edi + 0x7179ba0b], cl
test al, 0x91
invalid
push 0x7327ed45
mov dword [esp + 0x20], 0xd068d9ec
pushfd
pushfd
lea esp, [esp + 0x28]
jmp fcn.004a772f
push dword [esp]
mov dword [esp + 0x48], esi
mov word [esp], bp
jmp 0x533548

Function at 0x555933
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x52ab8e
mov esi, 0x4de965
call fcn.004ffed5
lea esp, [esp + 0x3c]
ja 0x508cc2
mov esi, 0x4de965
call fcn.0055487a

Function at 0x555947
Capabilities:
Packed with generic packer

Disassembly:
nop
movzx si, cl
mov esi, dword [esp + 0x20]
push dword [esp + 8]
jmp loc.004d6a0a
pushal
movsx si, al
jmp 0x500616
Function at 0x1401280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x140128c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.014012a0