joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd053
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, eax
cmp esi, ecx
jle 0x4bd05d
lea eax, [ecx + 0x32]
mov edi, 0x65
cdq
idiv edi
mov eax, edx
inc ecx
xor byte [ebx], al
inc ebx
cmp esi, ecx
jg 0x4bd048
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bd500
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 2
jle 0x4bd545
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + ecx*2]
test ecx, ecx
jns 0x4bd53f
add ecx, 3
sar ecx, 2
mov dword [ebp - 0x18], ecx
xor edi, edi
mov eax, esi
jmp 0x4bd554
mov edx, dword [eax]
inc edi
add eax, 4
mov byte [edx], 0
cmp edi, dword [esi + 0x9c40]
jl 0x4bd54b
mov dword [ebp - 4], ebx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
mov eax, dword [ebx]
test eax, eax
je 0x4bd57b
add ebx, eax
jmp 0x4bd55f
cmp dword [ebp - 0x18], 1
jle 0x4bd598
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0053c6c7
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, eax
mov eax, dword [esi + 0x9c48]
sub edi, eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
mov eax, dword [ebx + 0x44]
push eax
push esi
call fcn.004becb8
add esp, 0x14
mov eax, dword [ebx]
test eax, eax
je 0x4bd5d8
add ebx, eax
jmp 0x4bd5a8
mov edx, dword [ebp - 0xc]
xor edi, edi
mov dword [esi + 0x9c48], edx
mov ebx, esi
mov edx, dword [ebp - 8]
mov dword [esi + 0x9c4c], edx
jmp 0x4bd60f
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x4bd60b
push edi
push esi
call fcn.004bee0c
add esp, 8
dec edi
add ebx, 0xfffffffc
dec dword [esi + 0x9c40]
inc edi
add ebx, 4
cmp edi, dword [esi + 0x9c40]
jl 0x4bd5f0
mov byte [esi + 0x9c54], 0
mov byte [esi + 0x9c64], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be6ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x56d444
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.00535f7c
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x158]
mov word [ebp - 0x28], 8
mov dword [ebp - 4], ecx
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x14
mov eax, dword [ebx + 0x3e4]
push eax
push 0x568639
push edx
call fcn.005392b8
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x144]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x56863c
lea eax, [ebp - 0x144]
push eax
call fcn.00535bec
add esp, 8
lea edx, [ebp - 0x158]
push edx
lea ecx, [ebp - 0x144]
push ecx
call fcn.00535bec
add esp, 8
push 0x568649
lea eax, [ebp - 0x144]
invalid
push eax
call fcn.00535bec
add esp, 8
push 0x56864e
lea edx, [ebp - 0x144]
push edx
call fcn.00535bec
mov word [ebp - 0x28], 0x20
add esp, 8
lea edx, [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.00543bd8
mov edx, eax
inc dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00543d04
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00543cd4
mov dl, 1
mov eax, dword [0x51ef78]
call fcn.00406edc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0052cc30
test al, al
jne 0x4be7f3
push 0
push ebx
call fcn.0048390c
add esp, 8
mov word [ebp - 0x28], 0x2c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov word [ebp - 0x28], 0x38
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x1c]
mov edx, 4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xc]
call fcn.00544020
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00543cd4
mov word [ebp - 0x28], 0x14
jmp 0x4be850
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4be878
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x28], 0x50
mov edx, 3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x28], 0x44
mov eax, dword [ebp - 0x3c]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x1c]
call fcn.00543cd4
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be744
Capabilities:
Get common file path

Disassembly:
or eax, 0x73694c54
je 0x4be6ef
outsd dx, dword [esi]
js 0x4be703
je 0x4be72b
insb byte es:[edi], dx
add dword gs:[eax], eax
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ebx + edi*2 + 0x6c0a0043], cl
bound edx, qword [ebx + 0x74]
popal
outsb dx, byte [esi]
popal
jb 0x4be730
adc byte [edx + 0x4f], ch
ja 0x4be740
jb 0x4be719
jb 0x4be738
ja 0x4be71f
imul edi, dword [eax + 0x65], 0x626c1364
dec edi
ja 0x4be751
jb 0x4be72a
jb 0x4be749
ja 0x4be740
popal
nop
pop es
add byte [ebx], dh
sal byte [ebx], cl
leave
dec ebp
cld
mov dword [ebp - 0x28], 0x838b0014
in al, 3
add byte [eax], al
or al, 0x68
add al, 1
add byte [eax], al
mov esp, 0x51fffffe
add byte [eax + 0x3c], ch
xchg byte [esi], dl
mov esp, 0x50fffffe
Function at 0x4bfd90
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff920
mov eax, 0x56d73c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
call fcn.00535f7c
mov word [ebp - 0x34], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x6e0]
invalid
inc ebp
Function at 0x4c0c48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x8005
push edi
call fcn.004c0de8
add esp, 8
xor eax, eax
cmp eax, dword [ebp + 0x10]
jae 0x4c0c8b
movzx edx, bx
sar edx, 8
xor ecx, ecx
mov cl, byte [esi]
inc esi
xor edx, ecx
inc eax
shl ebx, 8
mov dx, word [edi + edx*4 + 0x30]
xor dx, bx
cmp eax, dword [ebp + 0x10]
mov ebx, edx
jb 0x4c0c6b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c0c94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4c0ccf
mov eax, dword [ebp + 0x14]
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.00535b48
add esp, 0xc
les ecx, [ebx + esi]
shr cl, 0x10
add dword [eax], eax
invalid
push ebx
call fcn.00535344
pop ecx
mov edi, eax

Function at 0x4d6cf4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d7c2c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x571a44
push ebx
push esi
mov esi, dword [ebp + 0xc]
call fcn.00535f7c
mov dword [ebp - 0x158], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d7cb1
mov word [ebp - 0x20], 8
mov edx, str.error1
lea eax, [ebp - 4]
call fcn.00543bd8
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00543d04
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.00543cd4
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4d7d80
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4d7d2c
cmp esi, dword [ebp - 0x150]
jne 0x4d7d1b
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x134]
lea eax, [ebp - 8]
call fcn.00543bd8
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.00543d04
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.00543cd4
pop eax
mov word [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4d7d80
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4d7cc2
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x20], 0x38
mov edx, 0x5718b3
lea eax, [ebp - 0xc]
call fcn.00543bd8
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00543d04
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x44
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.00543cd4
pop eax
mov word [ebp - 0x20], 0x38
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d940c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jne 0x4d9437
xor eax, eax
jmp 0x4d9547
lea edx, [ebp - 0x104]
push edx
push ebx
call fcn.004d9550
mov ecx, dword [ebp + 0xc]
add esp, 8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x30c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x30c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00535c7c
pop ecx
dec eax
lea edx, [ebp + eax - 0x30c]
test eax, eax
jle 0x4d9496
movsx ecx, byte [edx]
cmp ecx, 0x5c
je 0x4d9496
dec eax
dec edx
test eax, eax
jg 0x4d9488
mov byte [ebp + eax - 0x30c], 0
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.00535d75
add esp, 8
lea ecx, [ebp - 0x30c]
cmp eax, ecx
jne 0x4d94c5
mov al, 1
jmp 0x4d9547
lea edi, [ebp - 0x208]
mov esi, 0x57238f
mov eax, edi
lea edx, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0x208]
push ecx
call fcn.00535bec
add esp, 8
lea eax, [ebp - 0x30c]
lea edx, [ebp - 0x208]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d9518
test cl, cl
je 0x4d9512
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d9518
add eax, 2
add edx, 2
test cl, cl
jne 0x4d94f6
jne 0x4d9518
mov al, 1
jmp 0x4d9547
lea eax, [ebp - 0x30c]
mov edx, str._systemroot_system32
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d9545
test cl, cl
je 0x4d953f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d9545
add eax, 2
add edx, 2
test cl, cl
jne 0x4d9523
jne 0x4d9545
mov al, 1
jmp 0x4d9547
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9584
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x572178
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d940c
add esp, 8
test al, al
jne 0x4d95bd
xor eax, eax
jmp 0x4d9658
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00535c7c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d95e3
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d95e3
dec ebx
dec eax
test ebx, ebx
jg 0x4d95d5
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00535ad8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d9620
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d9614
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.00535d7c
add esp, 0xc
test eax, eax
je 0x4d964d
inc ebx
cmp ebx, 7
jl 0x4d9622
cmp ebx, 7
jge 0x4d9656
mov al, 1
jmp 0x4d9658
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d9660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x572204
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d940c
add esp, 8
test al, al
jne 0x4d9699
xor eax, eax
jmp 0x4d9734
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00535c7c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d96bf
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d96bf
dec ebx
dec eax
test ebx, ebx
jg 0x4d96b1
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00535ad8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d96fc
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d96f0
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.00535d7c
add esp, 0xc
test eax, eax
je 0x4d9729
inc ebx
cmp ebx, 4
jl 0x4d96fe
cmp ebx, 4
jge 0x4d9732
mov al, 1
jmp 0x4d9734
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d973c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4d975d
xor eax, eax
jmp 0x4d986d
push ebx
call fcn.00535344
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x4d97a5
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00535ad8
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push str._04X_04X
push ecx
call fcn.005392b8
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x4d9864
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, str.StringFileInfo_
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.00535bec
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.00535bec
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4d9857
cmp dword [ebp - 8], 0x32
jae 0x4d9857
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.00535ad8
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x4d97d0
push edi
call fcn.0053517c
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov esi, 0x572290
lea edi, [ebp - 0x154]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, 0x5722e0
lea edi, [ebp - 0x1b8]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004d940c
add esp, 8
test al, al
jne 0x4d98bf
xor eax, eax
jmp 0x4d99ad
mov edx, dword [ebp + 0xc]
push edx
call fcn.00535c7c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d98e5
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d98e5
dec ebx
dec eax
test ebx, ebx
jg 0x4d98d7
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00535ad8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d9922
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d9916
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x154]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.00535d7c
add esp, 0xc
test eax, eax
je 0x4d994f
inc ebx
cmp ebx, 4
jl 0x4d9924
cmp ebx, 4
jge 0x4d99ab
push 2
lea eax, [ebp - 0x1b8]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d973c
add esp, 0x10
test al, al
jne 0x4d9975
xor eax, eax
jmp 0x4d99ad
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x4d
jne 0x4d9990
cmp byte [eax + 2], 0x63
jne 0x4d9990
cmp byte [eax + 4], 0x6f
jne 0x4d9990
mov al, 1
jmp 0x4d99ad
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x57
jne 0x4d99ab
cmp byte [eax + 1], 0x69
jne 0x4d99ab
cmp byte [eax + 2], 0x6e
jne 0x4d99ab
mov al, 1
jmp 0x4d99ad
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc08c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
cmp byte [esi], 0xa0
jb 0x4dc0a6
cmp byte [esi + 1], 0xa0
jae 0x4dc0b1
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
jmp 0x4dc258
mov eax, ebx
call fcn.004f3884
cmp al, 5
jne 0x4dc258
mov eax, ebx
mov dword [ebp - 0x20], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x20]
add eax, 3
test eax, eax
jns 0x4dc0db
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x24], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
dec edx
call fcn.004f3908
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x4dc258
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jge 0x4dc258
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dc258
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x4dc258
push 2
push esi
lea eax, [ebp - 6]
push eax
call fcn.00535ad8
add byte [ebp - 6], 0x60
add byte [ebp - 5], 0x60
xor edx, edx
xor eax, eax
mov dl, byte [ebp - 6]
mov al, byte [ebp - 5]
add esp, 0xc
lea ecx, [edx + edx*2]
shl ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, eax
mov eax, ecx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xfffff718
test eax, eax
jb 0x4dc185
cmp eax, 0x2feb0
jb 0x4dc190
mov edx, dword [ebp + 0x10]
add dword [edx], 0xc
jmp 0x4dc258
push 0x18
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.00535ad8
add esp, 0xc
lea edx, [ebp - 0x40]
xor eax, eax
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0x18
jl 0x4dc1a9
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dc054
pop ecx
xor edx, edx
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dc244
cmp eax, dword [ebp - 0x18]
jge 0x4dc244
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x20]
mov bx, word [eax]
mov cx, 1
mov eax, ebx
movzx ebx, bx
sar ebx, 8
shl eax, 8
or ax, bx
mov ebx, eax
mov eax, dword [ebp - 0x18]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x24]
add eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
xor eax, eax
mov esi, 0xf
sub esi, eax
add esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x1c]
jge 0x4dc23c
cmp eax, 4
jl 0x4dc23c
test cx, bx
jbe 0x4dc23c
mov esi, 0xf
sub esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*2]
mov si, word [ebp - 0xe]
mov word [edi], si
add ecx, ecx
inc eax
cmp eax, 0x10
jl 0x4dc20f
inc edx
add dword [ebp - 0x28], 2
cmp edx, 0xc
jl 0x4dc1c9
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
cmp bl, 0x20
jb 0x4dc279
cmp bl, 0x7f
jb 0x4dc284
mov eax, dword [ebp + 0x10]
add dword [eax], 6
jmp 0x4dc3e7
mov eax, esi
call fcn.004f3884
cmp al, 5
jne 0x4dc3e7
mov eax, esi
mov dword [ebp - 0x1c], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x1c]
add eax, 3
test eax, eax
jns 0x4dc2ae
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x20], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, esi
dec edx
call fcn.004f3908
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff4
jle 0x4dc3e7
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jge 0x4dc3e7
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dc3e7
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x14]
jge 0x4dc3e7
xor eax, eax
mov al, bl
shl eax, 2
lea eax, [eax + eax*2]
add eax, 0xfffffe80
test eax, eax
jb 0x4dc32d
cmp eax, 0x474
jb 0x4dc338
mov edx, dword [ebp + 0x10]
add dword [edx], 6
jmp 0x4dc3e7
push 0xc
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x30]
push eax
call fcn.00535ad8
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x30]
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0xc
jl 0x4dc351
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dc054
pop ecx
xor edx, edx
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dc3d8
cmp eax, dword [ebp - 0x14]
jge 0x4dc3d8
mov cl, 1
mov eax, dword [ebp - 0x14]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
imul ebx, dword [ebp - 0x1c]
add eax, ebx
mov dword [ebp - 8], eax
xor eax, eax
mov ebx, dword [ebp - 0x24]
mov esi, ebx
mov ebx, 8
sub ebx, eax
add ebx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 0x18]
jge 0x4dc3d0
cmp eax, 2
jl 0x4dc3d0
test byte [esi], cl
jbe 0x4dc3d0
mov ebx, 8
sub ebx, eax
mov edi, dword [ebp - 8]
lea edi, [edi + ebx*2]
mov bx, word [ebp - 0xa]
mov word [edi], bx
add ecx, ecx
inc eax
cmp eax, 8
jl 0x4dc3a4
inc edx
inc dword [ebp - 0x24]
cmp edx, 0xc
jl 0x4dc371
mov eax, dword [ebp + 0x10]
add dword [eax], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dc54c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.004dc4d8
mov eax, dword [ebp + 8]
add eax, esi
jmp 0x4dc584
mov edx, ebx
shr edx, 0x18
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov edx, dword [ecx*4 + 0x5804a0]
mov cl, byte [eax]
shl ebx, 8
and ecx, 0xff
or ebx, ecx
xor ebx, edx
inc eax
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x4dc561
mov eax, ebx
pop esi
pop ebx
pop ebp
ret