joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4e5c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4b4f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004b4430
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4b4f2b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a184
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b5714
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a068
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b5788
jmp 0x4b4f3d
xor edx, edx
mov eax, ebx
call fcn.004b5714
xor edx, edx
mov eax, ebx
call fcn.004b5788
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4f6c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb4
ret

Function at 0x4bb714
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004bb948
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004bb948
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4bb788
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4bb7ad
inc esi
mov eax, edi
call fcn.004bb76c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004bb714
inc ebx
dec esi
jne 0x4bb797
pop edi
pop esi
pop ebx
ret
Function at 0x4bb83c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4bb8b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004bb7b4
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004bb76c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004bb714
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4bb87c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb8b8
lea eax, [ebp - 4]
call fcn.00404c90
ret
Function at 0x4bc474
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bc658
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4bc614
mov eax, dword [ebp - 4]
call fcn.004bddf0
cmp ebx, eax
jge 0x4bc614
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004b3b4c
mov edx, dword [0x4b47f4]
call fcn.00404020
mov esi, eax
mov eax, esi
call fcn.004b56a8
test al, al
je 0x4bc60a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4bc5fe
xor eax, eax
push ebp
push 0x4bc5f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004bca2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041c2f0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004052dc
mov eax, dword [ebp - 8]
call fcn.004051a8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004bc7f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc642
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4bc5f6
mov eax, dword [ebp - 4]
call fcn.004bcab0
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a578
jmp 0x4bc642
mov eax, dword [ebp - 8]
call fcn.00404c90
jmp 0x4bc642
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409aa0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x417a64]
call fcn.0040d95c
call fcn.00404604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc65f
lea eax, [ebp - 0x54]
call fcn.00404c90
ret
Function at 0x4cba8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x4cbab6
cmp dword [ebx + 0x64], 0
jne 0x4cbab6
cmp dword [ebx + 0x6c], 0
jne 0x4cbab6
mov edi, esi
jmp 0x4cbb3d
cmp edi, 0xffffffff
jne 0x4cbabe
dec edi
jmp 0x4cbb3d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4cbb3d
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004cae88
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cbb0b
mov cx, word [esp]
sub cx, si
jmp 0x4cbb0d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cbaf4
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cbb33
mov cx, word [esp]
sub cx, si
jmp 0x4cbb35
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cbb1c
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4cbb9a
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004cb828
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4cbb85
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4cbb9a
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cba96
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d1df0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x51227c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d1e12
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d1e14
shr eax, 1
dec edx
jne 0x4d1e00
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d1df9
mov byte [0x51267c], 1
pop esi
pop ebx
ret

Function at 0x4d1e30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x51267c], 0
jne 0x4d1e47
call fcn.004d1df0
mov eax, edi
dec eax
test eax, eax
jl 0x4d1e70
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51227c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d1e51
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4d440c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4d443d
dec al
je 0x4d4479
dec al
je 0x4d44bd
dec al
je 0x4d4528
jmp 0x4d45b2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d45b2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d444d
jmp 0x4d45b2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d45b2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d4489
jmp 0x4d45b2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d45b2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d44eb
xor ebp, ebp
jmp 0x4d44fc
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d4505
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d44cd
jmp 0x4d45b2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d45b2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d4580
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d1e78
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d453c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d8f9c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x50cdf8
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4d8fbb
mov esi, 1
mov edx, 0x50cf00
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4d9035
dec ebx
je 0x4d9059
dec ebx
je 0x4d907d
dec ebx
je 0x4d90a0
jmp 0x4d90b9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d90b9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d90b9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d90b9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4d9022
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4d8fd7
mov esi, 0x20
mov eax, 0x50ce28
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4d90de
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d9118
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x50ceaf]
test bl, bl
jbe 0x4d9149
lea eax, [esi + 0x3e0]
call fcn.004d90f8
lea eax, [esi + 0x3fc]
call fcn.004d90f8
dec bl
jne 0x4d912f
mov cl, 0x30
mov edi, 0x50ce80
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x4d916b
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4d917a
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4d9153
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d9188
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004d8f30
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d91a4
mov bl, 0x1c
mov esi, 0x50ce48
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004d8f30
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004d8f30
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4d91c0
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004d9118
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4d91e8
mov bl, 1
mov eax, 0x50cd78
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4d9221
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4d922e
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4d920d
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4d9258
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004d8f9c
jmp 0x4d9280
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004d8f9c
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4d9288
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4d9240
mov bl, 0x40
mov esi, 0x50cdb8
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4d92ee
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4d92fd
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4d92d6
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004d8f58
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d930b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4da14c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4da1f8
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4da1f3
mov eax, ebp
mov edx, 8
call fcn.004052dc
push 1
mov eax, ebp
call fcn.004051a8
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004d9188
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dbd30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4dbd39
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4dbedd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dc078
xor eax, eax
push ebp
push 0x4dbebb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4dbd88
call fcn.004046b0
jmp 0x4dbec2
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4dbe4a
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dbdd8
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dbdd8
lea eax, [ebp - 0x10]
call fcn.004dbb00
push dword [ebp - 0x10]
push 0x4dbef8
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405010
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dbe0d
lea eax, [ebp - 0x18]
call fcn.004dbb00
push dword [ebp - 0x18]
push 0x4dbef8
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405010
mov eax, dword [ebp - 0x14]
call fcn.00405150
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dbea5
lea eax, [ebp - 0x20]
call fcn.004dbb00
push dword [ebp - 0x20]
push 0x4dbef8
push ebx
push 0x4dbf04
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405010
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004dbd00
jmp 0x4dbea5
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dbe6c
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dbe6c
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dbe82
mov eax, ebx
call fcn.00405150
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dbea5
lea eax, [ebp - 0x24]
mov ecx, 0x4dbf04
mov edx, ebx
call fcn.00404f9c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004dbd00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbec2
mov eax, dword [ebp - 4]
call fcn.004dc084
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbee4
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404cb4
ret
Function at 0x4ed654
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.004052dc
mov eax, esi
call fcn.004051a8
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.004036c0
cmp byte [ebp - 1], 0
jne 0x4ed6c7
mov eax, esi
call fcn.004051a8
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4ed6e0
sub al, 2
jb 0x4ed6e7
jmp 0x4ed6ec
mov ebx, 2
jmp 0x4ed6ec
mov ebx, 1
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4ed7ce
test edi, edi
jle 0x4ed748
mov eax, esi
call fcn.004051a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
jmp 0x4ed7c2
test edi, edi
jge 0x4ed78e
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004051a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4ed7c2
mov eax, esi
call fcn.004051a8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4ed704
mov al, byte [ebp - 1]
sub al, 1
jb 0x4ed7de
sub al, 2
jb 0x4ed817
jmp 0x4ed85e
cmp edi, 2
jne 0x4ed7e4
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4ed85e
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004051a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x50d214]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4ed7f4
jmp 0x4ed85e
cmp edi, 2
jne 0x4ed81d
dec ebx
test ebx, ebx
jle 0x4ed859
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004051a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x50d218]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4ed829
jmp 0x4ed859
inc ebx
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4ed84c
mov eax, esi
mov edx, ebx
call fcn.004052dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4