joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496e70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a848a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ax, word [0x70cae8]
mov word [ebp - 0x154], ax
push 0x102
push 0
lea ecx, [ebp - 0x152]
push ecx
call fcn.006665c0
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00404810
push eax
push 0x104
lea edx, [ebp - 0x154]
push edx
call fcn.0066ce0c
add esp, 0xc
push str..
lea eax, [ebp - 0x154]
push eax
call fcn.00497520
add esp, 8
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xffffffff
jne 0x496f2d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404770
jmp 0x4970ae
mov eax, 1
test eax, eax
je 0x497092
movsx ecx, byte [ebp - 0x270]
cmp ecx, 0x2e
je 0x497068
lea edx, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c8]
push ecx
push 0x70caf4
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.004886a0
add esp, 0xc
mov dword [ebp - 0x2cc], eax
mov ecx, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2d0]
push edx
lea eax, [ebp - 0x2bc]
push eax
call fcn.00497540
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.00404770
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00404770
lea ecx, [ebp - 0x2bc]
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.004066d0
mov edx, dword [ebp - 0x29c]
and edx, 0x10
je 0x497059
lea ecx, [ebp + 8]
call fcn.00404810
push eax
push 0x104
lea eax, [ebp - 0x154]
push eax
call fcn.0066ce0c
add esp, 0xc
push 0x70caf8
lea ecx, [ebp - 0x154]
push ecx
call fcn.00497520
add esp, 8
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.00497520
add esp, 8
mov ecx, dword [ebp + 0x24]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c0], esp
lea edx, [ebp - 0x154]
push edx
call fcn.00404630
mov dword [ebp - 0x2d4], eax
call fcn.00496e70
add esp, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.00404770
lea eax, [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 0x2a0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x49708d
jmp 0x497092
jmp 0x496f2d
mov edx, dword [ebp - 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x49af60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a8bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x16c], ecx
mov eax, dword [ebp - 0x16c]
mov dword [eax], vtable.EasyLog.0
push 1
mov ecx, dword [ebp - 0x16c]
add ecx, 8
call fcn.004558d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x16c]
add ecx, 0xb0
call fcn.004045c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x16c]
add ecx, 0xd0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [ebp - 0x16c]
mov dword [edx + 0xcc], 0
mov byte [ebp - 0x154], 0
push 0x103
push 0
lea eax, [ebp - 0x153]
push eax
call fcn.006665c0
add esp, 0xc
lea ecx, [ebp - 0x154]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp - 0x16c]
add ecx, 0xb0
call fcn.004047f0
push 0x3f
push 0x6c2dc8
lea ecx, [ebp - 0x15c]
call fcn.00454210
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x174]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00688c50
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x15c]
call fcn.00404a30
push str.Generatelic_debug.log
push 0x70d468
lea ecx, [ebp - 0x2c]
call fcn.00404630
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x17c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00488760
add esp, 0xc
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x184]
push ecx
mov ecx, dword [ebp - 0x16c]
add ecx, 0xb0
call fcn.00477970
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x48]
call fcn.00404770
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00404770
push 0x40
push 0xa
mov ecx, dword [ebp - 0x16c]
add ecx, 0xb0
call fcn.00404810
push eax
mov ecx, dword [ebp - 0x16c]
add ecx, 8
call fcn.00455b00
lea edx, [ebp - 0x158]
push edx
lea ecx, [ebp - 0x160]
call fcn.00404b20
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x164]
push edx
call fcn.00688c50
add esp, 8
lea ecx, [ebp - 0x164]
call fcn.00404a30
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x160]
call fcn.00404a30
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x168], esp
push str.___________________LOG_SYSTEM_START____________________n
call fcn.00404630
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x16c]
call fcn.0049aba0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x158]
call fcn.00404a30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x49f410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x60c], 1
push 0
call fcn.0049f660
add esp, 4
push eax
call fcn.0066c22a
add esp, 4
mov byte [ebp - 0x608], 0
push 0x3ff
push 0
lea eax, [ebp - 0x607]
push eax
call fcn.006665c0
add esp, 0xc
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x207]
push ecx
call fcn.006665c0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x608]
push edx
call fcn.0049f360
add esp, 8
call fcn.0066c23c
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_d.dat
lea ecx, [ebp - 0x208]
push ecx
call fcn.0066926d
add esp, 0x10
mov byte [ebp - 9], 0
mov byte [ebp - 0x209], 0
push 0x710a74
lea edx, [ebp - 0x608]
push edx
call fcn.00666bb0
add esp, 8
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x608]
push ecx
call fcn.00666bb0
add esp, 8
mov byte [ebp - 0x209], 0
lea edx, [ebp - 0x608]
push edx
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
cmp eax, dword [ebp + 0x10]
jle 0x49f517
mov dword [ebp - 0x60c], 0
jmp 0x49f63f
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x608]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0066c260
add esp, 0xc
mov dword [ebp - 0x614], 0
push 0x710a78
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
je 0x49f63f
push str.before_fwrite_r_n
call fcn.0066610b
add esp, 4
mov edx, dword [ebp - 0x614]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00669854
add esp, 0x10
mov dword [ebp - 0x618], eax
mov edx, dword [ebp - 0x618]
push edx
push str.after_fwrite_i__d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov eax, dword [ebp - 0x618]
cmp eax, dword [ebp + 0x18]
je 0x49f5f5
mov dword [ebp - 0x60c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp - 0x61c]
push ecx
push str.WriteFileData_Write_func_failed__erroridd_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
jmp 0x49f617
mov edx, dword [ebp + 0x18]
push edx
push str.WriteFileData_Write_func_success__write_Data_ilen_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov eax, dword [ebp - 0x614]
push eax
call fcn.00668459
add esp, 4
mov ecx, dword [ebp - 0x614]
push ecx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x60c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x4a0040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
push 0x14
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.006665c0
add esp, 0xc
push 0x710bec
lea edx, [ebp - 0x20]
push edx
call fcn.00666bb0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00666bb0
add esp, 8
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push str.HardwareDeviceMapSerialComm
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a0166
mov dword [ebp - 0x22c], 0
mov eax, 1
test eax, eax
je 0x4a015c
mov dword [ebp - 0x228], 0x100
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x224], ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x4a012b
jmp 0x4a015c
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x120]
push eax
call fcn.0066a2f0
add esp, 8
test eax, eax
jne 0x4a0148
mov byte [ebp - 1], 1
jmp 0x4a015c
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
jmp 0x4a00ce
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x4a2530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x4a254f
lea ecx, [ebp - 0x20]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
jne 0x4a2576
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x10], 6
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x10]
jmp 0x4a26da
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x18], 0
jne 0x4a25a0
cmp dword [ebp + 0x14], 0
jne 0x4a258b
cmp dword [ebp + 0x18], 0xffffffff
je 0x4a25a0
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x10]
jmp 0x4a26da
cmp dword [ebp + 0x14], 0
jne 0x4a25c5
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x18]
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0xc]
jae 0x4a26cc
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a26bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3e5
je 0x4a2635
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x10], ecx
jmp 0x4a26cc
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
cmp edx, eax
jne 0x4a26bc
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4a2664
cmp dword [ebp - 0x2c], 0x102
je 0x4a2691
jmp 0x4a26ac
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4a268f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x10], eax
jmp 0x4a26cc
jmp 0x4a26bc
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x10], 0x5b4
jmp 0x4a26cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x10], eax
jmp 0x4a26cc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx]
mov dword [ebp - 0x1c], eax
jmp 0x4a25d3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a2950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4a299a
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4a2a70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4a299a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
jmp 0x4a29aa
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4a29b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4a29d4
mov dword [ebp - 4], 1
mov dword [ebp + 8], 0x64
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x24], 0
je 0x4a2a57
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x20], 1
mov ecx, dword [ebp - 0xc]
call fcn.004a2280
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004a2770
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x4a2a21
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [ebp - 8], 0x102
jne 0x4a2a30
cmp dword [ebp - 4], 0
jne 0x4a29e4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x20], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x4a2a57
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a2f40
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x7f7810
call fcn.004a3340
add esp, 0xc
push 0x40
push 0x713e70
push 0x7f7810
push 0x7f7810
call fcn.004a3250
add esp, 0x10
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x4a2ff1
mov dword [ebp - 4], 0
jmp 0x4a2f8c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x10
jge 0x4a2fef
push 0x20
mov eax, dword [0x7c3b34]
push eax
push 0x7f77f0
call fcn.00668860
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x30
add ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x7c3b34]
push edx
call fcn.004a3150
add esp, 8
push 0x20
mov eax, dword [0x7c3b30]
push eax
mov ecx, dword [0x7c3b34]
push ecx
call fcn.004a32b0
add esp, 0xc
push 0x20
push 0x7f77f0
mov edx, dword [0x7c3b30]
push edx
call fcn.00668860
add esp, 0xc
jmp 0x4a2f83
jmp 0x4a3066
mov dword [ebp - 8], 0xf
jmp 0x4a3003
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x4a3066
push 0x20
mov ecx, dword [0x7c3b30]
push ecx
push 0x7f77f0
call fcn.00668860
add esp, 0xc
mov edx, dword [ebp - 8]
imul edx, edx, 0x30
add edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x7c3b30]
push eax
call fcn.004a3150
add esp, 8
push 0x20
mov ecx, dword [0x7c3b34]
push ecx
mov edx, dword [0x7c3b30]
push edx
call fcn.004a32b0
add esp, 0xc
push 0x20
push 0x7f77f0
mov eax, dword [0x7c3b34]
push eax
call fcn.00668860
add esp, 0xc
jmp 0x4a2ffa
push 0x40
push 0x713eb0
push 0x7f7810
push 0x7f7810
call fcn.004a3250
add esp, 0x10
push 0x40
push 0x7f7810
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a3390
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4a30a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x7f7850
call fcn.004a3340
add esp, 0xc
push 0x38
push 0x713f40
push 0x7f7850
push 0x7f7850
call fcn.004a3250
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x4a30e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x4a3140
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x713fa8]
push eax
push 0x1c
mov ecx, dword [0x7c3b3c]
push ecx
call fcn.004a32f0
add esp, 0xc
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x713fa8]
push eax
push 0x1c
mov ecx, dword [0x7c3b38]
push ecx
call fcn.004a32f0
add esp, 0xc
push 0x30
push 0x713f78
push 0x7f7850
mov edx, dword [ebp - 4]
imul edx, edx, 0x30
add edx, dword [ebp + 8]
push edx
call fcn.004a3250
add esp, 0x10
jmp 0x4a30d9
mov esp, ebp
pop ebp
ret

Function at 0x4a3150
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push 0x30
push 0x713ef0
mov eax, dword [ebp + 8]
push eax
push 0x7f7890
call fcn.004a3250
add esp, 0x10
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
push 0x7f7890
call fcn.004a32b0
add esp, 0xc
push 0x7f7890
mov edx, dword [ebp + 8]
push edx
call fcn.004a31b0
add esp, 8
push 0x20
push 0x713f20
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a3250
add esp, 0x10
pop ebp
ret
Function at 0x4a34a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 8], eax
push 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x5f]
push ecx
call fcn.004a36b0
add esp, 0xc
push 0x40
push 0x7c3b98
push 0x40
lea edx, [ebp - 0x5f]
push edx
call fcn.004a3810
add esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
call fcn.004a3a20
add esp, 4
mov byte [ebp - 1], 1
jmp 0x4a34f5
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
cmp edx, 0xf
jg 0x4a35d1
push 0x20
lea eax, [ebp - 0x3f]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.00668860
add esp, 0xc
push 0x30
push 0x7c3c18
push 0x20
lea edx, [ebp - 0x3f]
push edx
call fcn.004a3810
add esp, 0x10
mov al, byte [ebp + 8]
mov byte [ebp - 0x84], al
cmp byte [ebp - 0x84], 1
je 0x4a3546
cmp byte [ebp - 0x84], 2
je 0x4a3564
jmp 0x4a3587
push 0x30
movzx ecx, byte [ebp - 1]
imul ecx, ecx, 0x31
add ecx, 0x7f78c1
push ecx
lea edx, [ebp - 0x3f]
push edx
call fcn.004a39d0
add esp, 0xc
jmp 0x4a3587
push 0x30
movzx eax, byte [ebp - 1]
mov ecx, 0x11
sub ecx, eax
imul ecx, ecx, 0x31
add ecx, 0x7f78c1
push ecx
lea edx, [ebp - 0x3f]
push edx
call fcn.004a39d0
add esp, 0xc
lea eax, [ebp - 0x3f]
push eax
call fcn.004a3890
add esp, 4
push 0x20
push 0x7c3e48
push 0x20
lea ecx, [ebp - 0x3f]
push ecx
call fcn.004a3810
add esp, 0x10
push 0x20
lea edx, [ebp - 0x5f]
push edx
lea eax, [ebp - 0x3f]
push eax
call fcn.004a39d0
add esp, 0xc
push 0x20
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x5f]
push edx
call fcn.00668860
add esp, 0xc
jmp 0x4a34ec
push 0x20
lea eax, [ebp - 0x3f]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.00668860
add esp, 0xc
push 0x30
push 0x7c3c18
push 0x20
lea edx, [ebp - 0x3f]
push edx
call fcn.004a3810
add esp, 0x10
movsx eax, byte [ebp + 8]
cmp eax, 1
jne 0x4a3616
push 0x30
push 0x7f7bd1
lea ecx, [ebp - 0x3f]
push ecx
call fcn.004a39d0
add esp, 0xc
jmp 0x4a3629
push 0x30
push 0x7f78f2
lea edx, [ebp - 0x3f]
push edx
call fcn.004a39d0
add esp, 0xc
lea eax, [ebp - 0x3f]
push eax
call fcn.004a3890
add esp, 4
push 0x20
push 0x7c3e48
push 0x20
lea ecx, [ebp - 0x3f]
push ecx
call fcn.004a3810
add esp, 0x10
push 0x20
lea edx, [ebp - 0x3f]
push edx
lea eax, [ebp - 0x5f]
push eax
call fcn.004a39d0
add esp, 0xc
push 0x20
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x3f]
push edx
call fcn.00668860
add esp, 0xc
push 0x40
push 0x7c3bd8
push 0x40
lea eax, [ebp - 0x5f]
push eax
call fcn.004a3810
add esp, 0x10
lea ecx, [ebp - 0x5f]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.004a3730
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x4a3890
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], 0x7c3c48
mov dword [ebp - 0x28], 0x7c3c88
mov dword [ebp - 0x24], 0x7c3cc8
mov dword [ebp - 0x20], 0x7c3d08
mov dword [ebp - 0x1c], 0x7c3d48
mov dword [ebp - 0x18], 0x7c3d88
mov dword [ebp - 0x14], 0x7c3dc8
mov dword [ebp - 0x10], 0x7c3e08
mov dword [ebp - 0xc], 0
jmp 0x4a38e0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jae 0x4a3979
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx + 1]
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + ecx + 2]
shl ecx, 2
lea edx, [ecx + eax*8]
mov eax, dword [ebp - 0xc]
imul eax, eax, 6
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 3]
lea ecx, [edx + eax*2]
mov edx, dword [ebp - 0xc]
imul edx, edx, 6
mov eax, dword [ebp + 8]
movzx edx, byte [eax + edx + 4]
add ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0xc]
imul eax, eax, 6
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, dword [ebp - 0xc]
imul eax, eax, 6
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + eax + 5]
lea ecx, [eax + edx*2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
shl edx, 4
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add edx, dword [ebp + eax*4 - 0x2c]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
push eax
call fcn.004a3980
add esp, 8
jmp 0x4a38d7
mov esp, ebp
pop ebp
ret

Function at 0x4a39d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x4a39e2
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp + 0x10]
cmp ecx, edx
jge 0x4a3a12
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
xor eax, ecx
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx + ecx], al
jmp 0x4a39da
mov esp, ebp
pop ebp
ret

Function at 0x4a3a20
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 8], eax
push 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x4f]
push ecx
call fcn.004a36b0
add esp, 0xc
push 0x38
push str.91__
push 0x40
lea edx, [ebp - 0x4f]
push edx
call fcn.004a3810
add esp, 0x10
mov byte [ebp - 1], 1
jmp 0x4a3a68
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0x10
jg 0x4a3ad6
movzx edx, byte [ebp - 1]
movzx eax, byte [edx + 0x7c3ed0]
push eax
lea ecx, [ebp - 0x4f]
push ecx
call fcn.004a3af0
add esp, 8
push 0x38
lea edx, [ebp - 0x4f]
push edx
lea eax, [ebp - 0x8b]
push eax
call fcn.00668860
add esp, 0xc
push 0x30
push 0x7c3ea0
push 0x38
lea ecx, [ebp - 0x8b]
push ecx
call fcn.004a3810
add esp, 0x10
push 0x30
lea edx, [ebp - 0x8b]
push edx
movzx eax, byte [ebp - 1]
imul eax, eax, 0x31
add eax, 0x7f78c1
push eax
call fcn.00668860
add esp, 0xc
jmp 0x4a3a60
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret