joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493fbe
Capabilities:
Print debug messages

Disassembly:
push 0x4fc
mov eax, 0x50cdf8
call fcn.0049e056
mov edi, dword [ebp + 8]
push str.RefreshDevice_is_called.__r_n
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, esi
call fcn.004932e0
push dword [esi + 0x2a4]
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi]
push eax
push str.RefreshDevice_info__x__x__CurrentState_is__d
push 3
call fcn.00409c47
push eax
call fcn.00474128
add esp, 0x18
push edi
lea ecx, [esi + 0x1c]
call fcn.00413f32
mov edi, dword [esi + 0x2a4]
mov ecx, esi
call fcn.004932ee
test edi, edi
jle 0x494030
cmp edi, 1
je 0x494030
cmp edi, 9
jne 0x4940da
lea ecx, [ebp - 0x508]
call fcn.0040b6e5
and dword [ebp - 4], 0
lea eax, [ebp - 0x508]
push eax
mov ecx, esi
call fcn.0049377d
call fcn.00491544
mov ecx, eax
call fcn.0045a40c
mov edx, dword [eax]
push 0
push 2
lea ecx, [ebp - 0x508]
push ecx
push 0xf
mov ecx, eax
call dword [edx]
push 0xc
mov ecx, esi
mov byte [esi + 0x27e], 1
call fcn.004933d4
lea ecx, [ebp - 0x28c]
call fcn.0040b6e5
lea eax, [ebp - 0x28c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0049377d
call fcn.00491544
mov ecx, eax
call fcn.00442fe7
mov edx, dword [eax]
push 0
lea ecx, [ebp - 0x28c]
push ecx
push 0x32
mov ecx, eax
call dword [edx]
push 0
call fcn.00406523
mov ecx, eax
call fcn.004916fc
lea ecx, [ebp - 0x28c]
call fcn.00406269
lea ecx, [ebp - 0x508]
call fcn.00406269
mov al, 1
call fcn.0049e0d9
ret 4

Function at 0x494171
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004933a3
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push esi
push 0x494140
push eax
push eax
call fcn.0049ab60
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x494cb7
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004933a3
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push esi
push 0x494c3d
push eax
push eax
call fcn.0049ab60
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x494ce2
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004933a3
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push esi
push 0x494c6e
push eax
push eax
call fcn.0049ab60
add esp, 0x18
mov dword [esi + 0x2f8], eax
pop esi
pop ecx
ret
Function at 0x49577d
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x50d082
call fcn.0049dfed
mov esi, ecx
lea edi, [esi + 0x10]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x44]
mov byte [esi + 4], bl
mov dword [esi + 8], ebx
call fcn.004019f3
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x4955d9
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call fcn.0049ab60
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040184d
call fcn.0049e0c5
ret 0x1c

Function at 0x495854
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push str.GlobalSogouDownloadDriverMutexXn4uytEx980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
cmp eax, 5
je 0x49587b
cmp eax, 0xb7
jne 0x49587d
mov bl, 1
test esi, esi
je 0x495888
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4958a4
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push str.GlobalSogouInstallDriverMutex012345
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
cmp eax, 5
je 0x4958cb
cmp eax, 0xb7
jne 0x4958cd
mov bl, 1
test esi, esi
je 0x4958d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x495982
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x81a8]
mov eax, 0x8228
call fcn.004a1280
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp + 0x81a4], eax
mov eax, dword [ebp + 0x81b8]
push ebx
push esi
mov esi, dword [ebp + 0x81b0]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x81c0]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x81b4]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x64], ebx
call fcn.0047ff5d
test eax, eax
je 0x4959f2
lea eax, [ebp - 0x7c]
push eax
call fcn.0049592c
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x495a07
lea eax, [ebp - 0x60]
push eax
push 0x101
jmp 0x4959fb
lea eax, [ebp - 0x60]
push eax
push 0x20019
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], ebx
jne 0x495a2c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x495a2c
cmp dword [ebp - 0x6c], ebx
jne 0x495a34
mov dword [ebp - 0x64], ebx
jmp 0x495afd
xor esi, esi
cmp dword [ebp - 0x6c], ebx
jle 0x495afd
xor eax, eax
push 0x1fc
mov word [ebp + 0x7fa4], ax
lea eax, [ebp + 0x7fa6]
push ebx
push eax
mov dword [ebp - 0x80], 0xff
call fcn.0049d740
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x7fa4]
push eax
push esi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x495b56
push 0x7ffe
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x68], 0x3fff
call fcn.0049d740
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x81bc]
push eax
push ebx
lea eax, [ebp + 0x7fa4]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp byte [ebp + 0x81c8], bl
jne 0x495b30
mov eax, dword [ebp - 0x68]
shr eax, 1
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x5c]
push eax
call fcn.0049b384
add esp, 0xc
test eax, eax
jne 0x495b56
push 0x1fe
lea eax, [ebp + 0x7fa4]
push eax
push dword [ebp - 0x74]
call fcn.0049d7c0
mov dword [ebp - 0x64], 1
add esp, 0xc
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], ebx
pop edi
pop esi
pop ebx
je 0x495b18
lea eax, [ebp - 0x7c]
push eax
call fcn.00495956
pop ecx
mov ecx, dword [ebp + 0x81a4]
mov eax, dword [ebp - 0x64]
xor ecx, ebp
call fcn.0049a49b
add ebp, 0x81a8
leave
ret
push dword [ebp - 0x70]
call fcn.0049d71b
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x5c]
push eax
call fcn.0049b384
add esp, 0x10
test eax, eax
jne 0x495b56
cmp word [ebp + 0x7fa6], 0x3f
jne 0x495adf
inc esi
cmp esi, dword [ebp - 0x6c]
jl 0x495a3f
jmp 0x495afd
Function at 0x4988d3
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x20
mov eax, 0x50d506
call fcn.0049dfed
mov edi, dword [ebp + 0x24c]
xor esi, esi
mov dword [ebp - 0x10], esi
xor eax, eax
push 0x206
mov word [ebp + 0x38], ax
lea eax, [ebp + 0x3a]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.0049d740
add esp, 0xc
push 0x104
lea eax, [ebp + 0x38]
push eax
push str._temp__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x250]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00403757
xor ebx, ebx
inc ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], 0x5c
call fcn.00407a14
cmp eax, 0xffffffff
jne 0x498989
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x1c]
mov dword [ebp - 0x10], 0x2f
call fcn.00407a14
cmp eax, 0xffffffff
jne 0x498989
push 0x535d58
mov ecx, edi
call fcn.00401685
jmp 0x4989d1
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004037a5
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
push eax
mov byte [ebp - 4], 2
call fcn.004120ff
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0040184d
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00403757
push esi
push ebx
lea ecx, [ebp]
call fcn.0040184d
push esi
push ebx
lea ecx, [ebp + 0x1c]
call fcn.0040184d
push esi
push ebx
lea ecx, [ebp + 0x250]
call fcn.0040184d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0049a49b
add ebp, 0x244
leave
ret 0x28
Function at 0x49941e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x32c
lea ebp, [esp - 4]
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp + 0x32c], eax
push 4
mov eax, 0x50d623
call fcn.0049dfed
mov eax, dword [ebp + 0x338]
mov ebx, dword [ebp + 0x33c]
mov esi, ecx
mov ecx, dword [ebp + 0x340]
xor edi, edi
mov dword [ebp - 0x10], ecx
cmp eax, edi
jne 0x499466
xor eax, eax
jmp 0x4995bf
cmp ebx, edi
je 0x49945f
cmp ecx, edi
je 0x49945f
push eax
lea ecx, [ebp]
call fcn.0040accb
push edi
lea ecx, [ebp + 0x104]
mov dword [ebp - 4], edi
mov dword [ebp + 0x11c], 0xf
call fcn.00401979
lea eax, [ebp + 0x104]
push eax
mov byte [ebp - 4], 1
call fcn.0043850a
pop ecx
cmp eax, edi
jne 0x4994c6
push edi
push 1
lea ecx, [ebp + 0x104]
call fcn.004017de
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x49945f
push dword [ebp]
call fcn.0049b145
pop ecx
jmp 0x49945f
xor eax, eax
push 0x208
mov word [ebp + 0x120], ax
lea eax, [ebp + 0x122]
push edi
push eax
call fcn.0049d740
add esp, 0xc
lea eax, [ebp + 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4994a5
cmp dword [ebp + 0x11c], 0x10
mov eax, dword [ebp + 0x108]
jae 0x49950f
lea eax, [ebp + 0x108]
push edi
lea ecx, [ebp + 0x120]
push ecx
push str.SoftwareSogouMobileToolSoDA
push reloc.WS2_32.dll_accept
push eax
call fcn.00417814
movzx eax, al
add esp, 0x14
cmp eax, edi
je 0x4994a5
call fcn.00417865
mov dword [esi + 8], eax
cmp eax, edi
je 0x4994a5
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x499550
xor ebx, ebx
jmp 0x499582
mov edx, dword [0x551a88]
push edi
push 1
inc edx
push edx
push ecx
push str.PDAAssistant
push eax
call fcn.0041787e
push ebx
push 0x535d5a
push dword [ebp]
push dword [esi + 8]
call fcn.004178dc
movzx ebx, al
add esp, 0x28
cmp ebx, edi
jne 0x499596
mov eax, dword [esi + 8]
cmp eax, edi
je 0x49959e
push eax
mov ecx, esi
call fcn.004991c3
mov dword [esi + 8], edi
jmp 0x49959e
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
push edi
push 1
lea ecx, [ebp + 0x104]
call fcn.004017de
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4995bd
push dword [ebp]
call fcn.0049b145
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x32c]
xor ecx, ebp
call fcn.0049a49b
add ebp, 0x330
leave
ret 0xc

Function at 0x49a49b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x551bd0]
jne 0x49a4a5
repz ret
jmp fcn.004a4c4f
Function at 0x4a16c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4a16f9
call fcn.004a4b84
mov dword [eax], esi
call fcn.004a4b71
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0049af01
add esp, 0x14
push 0x16
pop eax
jmp 0x4a174e
test dword [ebp + 0xc], 0xfffffff9
jne 0x4a16d5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a1726
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a4b97
pop ecx
call fcn.004a4b71
mov eax, dword [eax]
jmp 0x4a174e
test al, 0x10
jne 0x4a174c
test al, 1
je 0x4a174c
test byte [ebp + 0xc], 2
je 0x4a174c
call fcn.004a4b84
mov dword [eax], 5
call fcn.004a4b71
mov dword [eax], 0xd
jmp 0x4a171d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4b6a35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004a67a0
and dword [ebp - 4], 0
cmp dword [0x559e30], 0
mov ebx, eax
jne 0x4b6ae6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b6b97
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4b6b97
push eax
call fcn.004a672e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x559e30], eax
call esi
push eax
call fcn.004a672e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x559e34], eax
call esi
push eax
call fcn.004a672e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x559e38], eax
call esi
push eax
call fcn.004a672e
pop ecx
mov dword [0x559e40], eax
test eax, eax
je 0x4b6ae6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004a672e
pop ecx
mov dword [0x559e3c], eax
mov eax, dword [0x559e3c]
cmp eax, ebx
je 0x4b6b3e
cmp dword [0x559e40], ebx
je 0x4b6b3e
push eax
call fcn.004a67a9
push dword [0x559e40]
mov esi, eax
call fcn.004a67a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b6b3e
test edi, edi
je 0x4b6b3e
call esi
test eax, eax
je 0x4b6b35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b6b35
test byte [ebp - 0xc], 1
jne 0x4b6b3e
or dword [ebp + 0x10], 0x200000
jmp 0x4b6b77
mov eax, dword [0x559e34]
cmp eax, ebx
je 0x4b6b77
push eax
call fcn.004a67a9
pop ecx
test eax, eax
je 0x4b6b77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b6b77
mov eax, dword [0x559e38]
cmp eax, ebx
je 0x4b6b77
push eax
call fcn.004a67a9
pop ecx
test eax, eax
je 0x4b6b77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x559e30]
call fcn.004a67a9
pop ecx
test eax, eax
je 0x4b6b97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b6b99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4bd61c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x4bd645
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x52d328]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x4bd625
pop esi
ret

Function at 0x4bdab0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push edi
test eax, eax
je 0x4bdaf1
cdq
push esi
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.004b1d70
push edi
push esi
push edx
push eax
call fcn.004b1f10
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
pop esi
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.004bd951
pop ecx
pop ecx
test eax, eax
jne 0x4bdb1a
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4bdb21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x4bdb4c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4bdb7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4bdb7c
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x4bdb9c
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.004b1f10
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4bde9c
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x14]
xor ebp, ebp
xor ebx, ebx
call fcn.004bde65
mov edi, eax
pop ecx
test edi, edi
jne 0x4bdebb
push 7
pop eax
jmp 0x4bdf44
push esi
call fcn.004bd768
test eax, eax
je 0x4bdef7
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bdee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4bdf29
inc ebp
cmp ebp, 5
jge 0x4bdf29
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4bdec5
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bdf19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4bdf29
inc ebp
cmp ebp, 5
jge 0x4bdf29
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4bdef7
push edi
call fcn.0049b145
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x4bdf3f
cmp ebx, 2
jne 0x4bdf3f
xor eax, eax
jmp 0x4bdf44
mov eax, 0xa0a
pop edi
pop ebp
pop ebx
ret
Function at 0x4c6bbe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
inc edx
cmp dword [ecx + 0x1c], edx
jbe 0x4c6c9d
push esi
lea eax, [ecx + 0x32]
push edi
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x556b30]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x556330]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x556730]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x555f30]
add eax, 0x10
mov dword [eax - 0x12], esi
movzx esi, byte [eax - 0xb]
mov esi, dword [esi*4 + 0x556b30]
movzx edi, byte [eax - 0xc]
xor esi, dword [edi*4 + 0x556730]
movzx edi, byte [eax - 0xd]
xor esi, dword [edi*4 + 0x556330]
movzx edi, byte [eax - 0xe]
xor esi, dword [edi*4 + 0x555f30]
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x556b30]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x556730]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x556330]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x555f30]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x556b30]
xor esi, dword [edi*4 + 0x556730]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x556330]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x555f30]
inc edx
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x1c]
jb 0x4c6bd3
pop edi
pop esi
ret
Function at 0x4c73da
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x128
test ecx, ecx
jle 0x4c7545
mov eax, dword [ebp + 8]
add eax, 0x88
push ebx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
add eax, 2
mov dword [ebp - 0x24], ecx
push edi
xor ecx, ecx
movzx edx, byte [eax - 2]
movzx esi, byte [eax - 1]
shl edx, 8
or edx, esi
movzx esi, byte [eax]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 1]
shl edx, 8
or edx, esi
mov dword [ebp + ecx*4 - 0x128], edx
inc ecx
add eax, 4
cmp ecx, 0x10
jl 0x4c7407
push 0x30
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xf0]
pop esi
mov edx, dword [eax]
mov ecx, dword [eax - 0x34]
mov edi, edx
rol edi, 0xf
mov ebx, edx
shr edx, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, edx
mov edx, ecx
rol edx, 0xe
mov ebx, ecx
ror ebx, 7
xor edx, ebx
shr ecx, 3
xor edx, ecx
add edi, edx
add edi, dword [eax - 0x38]
add eax, 4
add edi, dword [eax - 0x18]
dec esi
mov dword [eax + 4], edi
jne 0x4c7441
mov esi, dword [ebp + 0x10]
push 8
pop ecx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
xor edx, edx
mov edi, dword [ebp - 0xc]
mov eax, esi
ror eax, 0xb
mov ecx, esi
rol ecx, 7
xor eax, ecx
and edi, esi
mov ecx, esi
ror ecx, 6
xor eax, ecx
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
not ecx
and ecx, dword [ebp - 8]
and ebx, dword [ebp - 0x20]
xor ecx, edi
mov edi, dword [ebp - 0x20]
add eax, ecx
add eax, dword [edx + 0x557068]
mov ecx, dword [ebp - 0x20]
add eax, dword [ebp + edx - 0x128]
add edx, 4
add eax, dword [ebp - 4]
ror ecx, 0xd
rol edi, 0xa
xor ecx, edi
mov edi, dword [ebp - 0x20]
ror edi, 2
xor ecx, edi
mov edi, dword [ebp - 0x1c]
xor edi, dword [ebp - 0x20]
and edi, dword [ebp - 0x18]
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x20]
add ecx, eax
add esi, eax
cmp edx, 0x100
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
jl 0x4c7489
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
xor ecx, ecx
mov edx, dword [ebp + ecx*4 - 0x20]
add dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jl 0x4c7527
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
jne 0x4c7405
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c7547
Capabilities:
Hash data using sha256
Hash data using sha384

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x556fc8
lea ecx, [edx + 0x88]
push esi
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
cmp eax, 0x556fe8
jl 0x4c7557
and dword [edx + 4], 0
and dword [edx], 0
pop esi
ret
Function at 0x4cc1cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4cc2e7
test esi, esi
je 0x4cc2e7
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x4cc28b
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x4cc28b
xor cl, dl
test cl, 0x10
jne 0x4cc28b
mov al, byte [edi]
cmp al, byte [esi]
jne 0x4cc28b
push dword [esi + 8]
push dword [edi + 8]
call fcn.004cc1cf
pop ecx
pop ecx
test eax, eax
jne 0x4cc28b
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.004cc1cf
pop ecx
pop ecx
test eax, eax
jne 0x4cc28b
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.004c1929
test eax, eax
jne 0x4cc28b
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x4cc28b
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x4cc28b
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x4cc290
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x4cc28b
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x4cc2ba
push 2
pop eax
jmp 0x4cc2f2
cmp byte [edi], 0x98
je 0x4cc2ba
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4cc2ba
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x4cc28b
mov edx, dword [esi + 4]
test edx, edx
je 0x4cc28b
call fcn.004bcac2
test eax, eax
jne 0x4cc28b
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x4cc2d6
xor eax, eax
inc eax
jmp 0x4cc2f2
test cx, cx
je 0x4cc2e3
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x4cc28b
xor eax, eax
jmp 0x4cc2f2
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
ret