joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4740bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4740ed
dec al
je 0x474128
dec al
je 0x47416d
dec al
je 0x4741d6
jmp 0x474260
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x474260
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4740fd
jmp 0x474260
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x474260
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x474138
jmp 0x474260
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x474260
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x47419c
xor ebp, ebp
jmp 0x4741ac
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4741b5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x47417d
jmp 0x474260
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x474260
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x47422f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00471a68
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4741ea
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48988c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4898b0
cmp eax, 0
jbe 0x4899b9
jmp 0x4898b6
jle 0x4899b9
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.00403560
mov eax, dword [ebp + 8]
lea edx, [eax - 0x13c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x4899b9
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x4899b9
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x4899b9
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x4899b9
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x4899b9
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x4899b9
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x4899b9
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x4899b9
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x48a008
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf6]
test ax, ax
jbe 0x48a0e8
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x48a0e6
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x48a07e
test eax, 0x40000000
je 0x48a06a
test eax, 0x80000000
je 0x48a065
or edx, 0x40
jmp 0x48a0a5
or edx, 0x20
jmp 0x48a0a5
test eax, 0x80000000
je 0x48a079
or edx, 0x80
jmp 0x48a0a5
or edx, 0x10
jmp 0x48a0a5
test eax, 0x40000000
je 0x48a096
test eax, 0x80000000
je 0x48a091
or edx, 4
jmp 0x48a0a5
or edx, 2
jmp 0x48a0a5
test eax, 0x80000000
je 0x48a0a2
or edx, 8
jmp 0x48a0a5
or edx, 1
test eax, 0x4000000
je 0x48a0b2
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call sub.kernel32.dll_VirtualProtect
inc ebx
dec dword [ebp - 4]
jne 0x48a038
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48b338
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4fbc44]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x48b370
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x48b388
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48b381
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403560
xor edx, edx
mov eax, 0x4fbe44
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x48b3ef
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x48b3a6
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x48b630
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x48b649
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x48b642
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x48b65b
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48b654
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0048b228
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x48b675
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.0048b338
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x48b6fd
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x48b71b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0048b2b8
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x48b745
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48b75c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x78]
push ecx
mov ecx, 0x18
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
test ebx, ebx
js 0x48b784
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x48b77d
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x48b798
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0048b128
test bl, bl
jne 0x48b871
mov dword [ebp - 8], 0x10
lea eax, [ebp - 0x78]
mov dword [ebp - 0x14], eax
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x48b7cf
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x48b7e4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0048b630
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x48b817
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x48b7c4
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x48b83b
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x48b84d
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x48b862
jmp 0x48b930
cmp bl, 1
jne 0x48b930
mov dword [ebp - 8], 0xfffffff0
lea ebx, [ebp - 0x1e]
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x48b88f
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x48b8a4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0048b630
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x48b8d7
sub ebx, 6
inc dword [ebp - 8]
jne 0x48b884
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x48b8ff
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x48b911
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x48b926
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0048b1a8
mov edi, dword [ebp - 0x84]
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48ec50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x48ec7d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x48ecfc
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0048dd04
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48ecca
mov cx, word [esp]
sub cx, si
jmp 0x48eccc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48ecb3
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48ecf2
mov cx, word [esp]
sub cx, si
jmp 0x48ecf4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48ecdb
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48ed59
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0048e930
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48ed44
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48ed59
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48ec5a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x494e4c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x508d10
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x494e6e
shr eax, 1
xor eax, 0xedb88320
jmp 0x494e70
shr eax, 1
dec edx
jne 0x494e5c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x494e55
mov byte [0x509110], 1
pop esi
pop ebx
ret

Function at 0x494e8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x509110], 0
jne 0x494ea3
call fcn.00494e4c
mov eax, edi
dec eax
test eax, eax
jl 0x494ecb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x508d10]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x494ead
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x497320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x4973ba.0
jmp dword [ecx*4 + 0x497353]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x497385
sub dl, 8
je 0x497394
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49708c
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4970e4
jmp case.0x4973ba.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x4973ba.0
movzx ecx, byte [ecx + 0x4973c1]
jmp dword [ecx*4 + 0x4973d2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49713c
jmp case.0x4973ba.0
cmp dl, 3
jne 0x4973ff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x497190
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49714c
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4971d4
jmp case.0x4973ba.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x49742a
sub dl, 8
je 0x497436
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4971f0
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49725c
jmp case.0x4973ba.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x497455
sub dl, 8
je 0x497461
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4972cc
jmp case.0x4973ba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4972f4
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x4974f1
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00496680
test eax, eax
je 0x4974f1
mov eax, ebx
call fcn.004974fc
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x497491
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4974fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x49752d
dec al
je 0x497568
dec al
je 0x4975ad
dec al
je 0x497616
jmp 0x4976a0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4976a0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49753d
jmp 0x4976a0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4976a0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x497578
jmp 0x4976a0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4976a0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4975dc
xor ebp, ebp
jmp 0x4975ec
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4975f5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4975bd
jmp 0x4976a0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4976a0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49766f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00494ed4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49762a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49a140
Capabilities:
Clear file content
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f80
xor eax, eax
push ebp
push 0x49a2bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov edx, 0x42
mov eax, dword [ebp - 4]
call fcn.00409204
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, 0x270f
call fcn.004032d4
add eax, 0x3e8
lea edx, [ebp - 0x28]
call fcn.00408e38
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x49a2dc
call fcn.00404e18
mov eax, dword [ebp - 0x24]
call fcn.00404f90
push eax
push esi
push 0
push 4
push 0
push ebx
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov eax, esi
cdq
sub eax, dword [ebp + 0x10]
sbb edx, dword [ebp + 0x14]
cmp edx, dword [ebp + 0xc]
jne 0x49a1f2
cmp eax, dword [ebp + 8]
jae 0x49a205
jmp 0x49a1f4
jge 0x49a205
mov eax, esi
cdq
sub eax, dword [ebp + 0x10]
sbb edx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x49a211
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, esi
cdq
cmp edx, dword [ebp + 0x14]
jne 0x49a220
cmp eax, dword [ebp + 0x10]
jae 0x49a22d
jmp 0x49a222
jge 0x49a22d
mov eax, esi
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
jmp 0x49a239
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, edi
cdq
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
push eax
mov eax, edi
cdq
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
mov ecx, esi
sub ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x18]
pop edx
call fcn.00407708
test edi, edi
je 0x49a26a
push edi
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0xc], 0
je 0x49a279
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0x18]
neg edx
mov ecx, 2
mov eax, ebx
call fcn.004092b4
push ebx
call sub.kernel32.dll_SetEndOfFile
test ebx, ebx
je 0x49a29a
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a2c4
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404b24
lea eax, [ebp - 4]
call fcn.00404b00
ret