joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x49417d
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4941fc
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00492818
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4941ca
mov cx, word [esp]
sub cx, si
jmp 0x4941cc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4941b3
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4941f2
mov cx, word [esp]
sub cx, si
jmp 0x4941f4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4941db
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x494259
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00493e24
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x494244
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x494259
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x49415a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49a6fc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x557dec
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x49a71e
shr eax, 1
xor eax, 0xedb88320
jmp 0x49a720
shr eax, 1
dec edx
jne 0x49a70c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49a705
mov byte [0x5581ec], 1
pop esi
pop ebx
ret

Function at 0x49a73c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5581ec], 0
jne 0x49a753
call fcn.0049a6fc
mov eax, edi
dec eax
test eax, eax
jl 0x49a77b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x557dec]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x49a75d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49ced4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x49cf6e.0
jmp dword [ecx*4 + 0x49cf07]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49cf39
sub dl, 8
je 0x49cf48
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cb80
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cbd8
jmp case.0x49cf6e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x49cf6e.0
movzx ecx, byte [ecx + 0x49cf75]
jmp dword [ecx*4 + 0x49cf86]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cc84
jmp case.0x49cf6e.0
cmp dl, 3
jne 0x49cfb3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ccd8
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cc94
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cd1c
jmp case.0x49cf6e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49cfde
sub dl, 8
je 0x49cfea
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cd48
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49cdb4
jmp case.0x49cf6e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49d009
sub dl, 8
je 0x49d015
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ce70
jmp case.0x49cf6e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ce98
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x49d0b9
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049c08c
test eax, eax
je 0x49d0b9
mov eax, ebx
call fcn.0049d0c4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x49d052
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49d0c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x49d0f5
dec al
je 0x49d130
dec al
je 0x49d175
dec al
je 0x49d1de
jmp 0x49d268
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49d268
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49d105
jmp 0x49d268
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49d268
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49d140
jmp 0x49d268
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49d268
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49d1a4
xor ebp, ebp
jmp 0x49d1b4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49d1bd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49d185
jmp 0x49d268
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49d268
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49d237
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049a784
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49d1f2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a25a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4a25d5
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4a2654
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004a0c70
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a2622
mov cx, word [esp]
sub cx, si
jmp 0x4a2624
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a260b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a264a
mov cx, word [esp]
sub cx, si
jmp 0x4a264c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a2633
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4a26b1
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004a227c
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4a269c
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4a26b1
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4a25b2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a8b54
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5581f8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a8b76
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a8b78
shr eax, 1
dec edx
jne 0x4a8b64
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a8b5d
mov byte [0x5585f8], 1
pop esi
pop ebx
ret

Function at 0x4a8b94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5585f8], 0
jne 0x4a8bab
call fcn.004a8b54
mov eax, edi
dec eax
test eax, eax
jl 0x4a8bd3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5581f8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a8bb5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4ab250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x39]
movzx ecx, dl
cmp ecx, 6
ja case.0x4ab2e1.0
jmp dword [ecx*4 + 0x4ab280]
movzx edx, byte [eax + 0x38]
sub dl, 8
je 0x4ab2af
sub dl, 8
je 0x4ab2be
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4aaefc
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4aaf54
jmp case.0x4ab2e1.0
movzx ecx, byte [eax + 0x38]
cmp ecx, 0x10
ja case.0x4ab2e1.0
movzx ecx, byte [ecx + 0x4ab2e8]
jmp dword [ecx*4 + 0x4ab2f9]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab000
jmp case.0x4ab2e1.0
cmp dl, 3
jne 0x4ab326
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab054
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab010
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab098
jmp case.0x4ab2e1.0
movzx edx, byte [eax + 0x38]
sub dl, 8
je 0x4ab34e
sub dl, 8
je 0x4ab35a
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab0c4
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab130
jmp case.0x4ab2e1.0
movzx edx, byte [eax + 0x38]
sub dl, 8
je 0x4ab376
sub dl, 8
je 0x4ab382
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab1ec
jmp case.0x4ab2e1.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ab214
mov edx, dword [eax + 0x40]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x28]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x2c]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x24]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4ab417
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004aa43c
test eax, eax
je 0x4ab417
mov eax, ebx
call fcn.004ab420
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x40]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4ab3b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ab420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4ab451
dec al
je 0x4ab48c
dec al
je 0x4ab4d1
dec al
je 0x4ab53a
jmp 0x4ab5c4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4ab5c4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ab461
jmp 0x4ab5c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ab5c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ab49c
jmp 0x4ab5c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ab5c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ab500
xor ebp, ebp
jmp 0x4ab510
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ab519
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ab4e1
jmp 0x4ab5c4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ab5c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4ab593
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a8bdc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ab54e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ce1e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ce242
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ce1d8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004cb76c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004cb284
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce249
lea eax, [ebp - 4]
call fcn.004052a4
ret
Function at 0x4dfa64
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4dfafe
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4dfa83
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4dfb14
dec edx
je 0x4dfb49
jmp 0x4dfb9a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4dfb9a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dfc0c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4dfc2b
add edx, 3
sar edx, 2
test edx, edx
jle 0x4dfd39
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4dfc60
je 0x4dfca3
sub ecx, 0x2b
je 0x4dfc99
sub ecx, 4
je 0x4dfc9e
dec ecx
sub ecx, 0xa
jb 0x4dfc8b
jmp 0x4dfca6
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4dfc72
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4dfc7d
jmp 0x4dfca6
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4dfca6
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4dfca6
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4dfca6
mov byte [eax], 0x3e
jmp 0x4dfca6
mov byte [eax], 0x3f
jmp 0x4dfca6
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4dfc43
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4dfcf7
cmp byte [esp + 7], 0xff
jne 0x4dfcf7
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4dfd2e
cmp dl, 0xff
je 0x4dfd2e
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4dfc3a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4e08a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.004039dc
cmp dword [ebp - 4], 0
je 0x4e0954
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x4e0910
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.004e0828
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.0040313c
jmp 0x4e0920
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.0040313c
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x4e093a
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x4e0931
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4