joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed50c68
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
je 0x4ed50c9f
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4ed50cd3
push eax
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4ed50cd0
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp - 0x10c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4ed50cd3
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ecfd994
leave
ret 0xc

Function at 0x4ed50ce5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
je 0x4ed50d1e
push dword [ebp + 0x14]
push edi
push 3
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4ed50d50
push eax
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4ed50d4d
push dword [ebp + 0x14]
push edi
push 3
push 0
push dword [ebp - 0x10c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4ed50d50
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
leave
ret 0x10

Function at 0x4ed50d63
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x114], 4
je 0x4ed50daf
lea ecx, [ebp - 0x114]
push ecx
push edi
lea ecx, [ebp - 0x118]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4ed50de5
push eax
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4ed50dfb
lea eax, [ebp - 0x114]
push eax
push edi
lea eax, [ebp - 0x118]
push eax
push 0
push dword [ebp - 0x10c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ed50dfe
cmp dword [ebp - 0x118], 4
jne 0x4ed50dfb
cmp dword [ebp - 0x114], 4
je 0x4ed50dfe
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
leave
ret 0xc
Function at 0x4ed50e11
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x114], ecx
je 0x4ed50e5c
lea ecx, [ebp - 0x114]
push ecx
push edi
lea ecx, [ebp - 0x118]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4ed50e92
push eax
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4ed50eae
lea eax, [ebp - 0x114]
push eax
push edi
lea eax, [ebp - 0x118]
push eax
push 0
push dword [ebp - 0x10c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ed50eb1
cmp dword [ebp - 0x118], 3
jne 0x4ed50eae
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x114], eax
jne 0x4ed50eae
xor eax, eax
jmp 0x4ed50eb1
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
leave
ret 0x10

Function at 0x4ed51a0f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push 0x4edd01f4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4edda094]
cmp eax, 1
jne 0x4ed51a2e
xor ebx, ebx
jmp 0x4ed51b07
push 2
pop ecx
cmp eax, ecx
mov ebx, 0x80004005
je 0x4ed51b07
push edi
push 0x4ed51b9c
mov dword [0x4edda094], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x4edda098], eax
je 0x4ed51b06
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ed51b88
push eax
call esi
push 0x4ed51b74
push dword [0x4edda098]
mov dword [0x4edda09c], eax
call esi
push 0x4ed51b58
push dword [0x4edda098]
mov dword [0x4edda0a0], eax
call esi
push 0x4ed51b44
push dword [0x4edda098]
mov dword [0x4edda0a8], eax
call esi
push 0x4ed51b30
push dword [0x4edda098]
mov dword [0x4edda0b0], eax
call esi
push 0x4ed51b18
push dword [0x4edda098]
mov dword [0x4edda0a4], eax
call esi
cmp dword [0x4edda09c], edi
mov dword [0x4edda0ac], eax
pop esi
je 0x4ed51b06
cmp dword [0x4edda0a0], edi
je 0x4ed51b06
cmp dword [0x4edda0a4], edi
je 0x4ed51b06
cmp dword [0x4edda0a8], edi
je 0x4ed51b06
cmp eax, edi
je 0x4ed51b06
cmp dword [0x4edda0b0], edi
je 0x4ed51b06
mov dword [0x4edda094], 1
xor ebx, ebx
pop edi
push 0x4edd01f4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop ebx
ret
Function at 0x4ed51ed5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x18
call fcn.4ec52209
test eax, eax
je 0x4ed51ef1
mov ecx, eax
call fcn.4ed51e5c
mov esi, eax
jmp 0x4ed51ef3
xor esi, esi
test esi, esi
jne 0x4ed51efe
mov eax, 0x8007000e
jmp 0x4ed51f69
push ebx
push dword [ebp + 8]
call fcn.4ec865fb
test eax, eax
mov dword [esi + 0x10], eax
jne 0x4ed51f15
mov ebx, 0x8007000e
jmp 0x4ed51f56
push 0x80
push 4
push 1
push 0x40000000
push dword [ebp + 8]
mov dword [esi + 0x14], 1
call fcn.4ec866c8
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x4ed51f41
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esi + 0xc], 0xffffffff
jne 0x4ed51f50
call fcn.4ec8696c
mov ebx, eax
jmp 0x4ed51f52
xor ebx, ebx
test ebx, ebx
jge 0x4ed51f61
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x38]
jmp 0x4ed51f66
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8
Function at 0x4ed672e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x4ed67324
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4ed67309
push 0x4ed67314
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ed67309
push dword [ebp + 8]
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4ed67373
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [section..data]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4edd46a0]
je 0x4ed6739d
inc eax
cmp eax, 0x12
jb 0x4ed6738e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4edd46a0]
mov dword [ebp - 0x110], esi
jne 0x4ed67548
mov eax, dword [0x4edda0b4]
cmp eax, 1
je 0x4ed67516
test eax, eax
jne 0x4ed673d3
cmp dword [0x4edda0b8], 1
je 0x4ed67516
cmp ecx, 0xfc
je 0x4ed67548
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ed6740e
push 5
pop ecx
mov esi, 0x4ed675a8
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed67419
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x4ed67451
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed67431
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x4ed675a4
push ebx
call fcn.4ecbb889
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed67456
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x4edd46a4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4ed67470
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.4ec71104
mov edx, esp
push 6
pop ecx
mov esi, 0x4ed67588
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed6749c
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4ed674a8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed674c1
mov eax, dword [ebp - 0x110]
mov esi, 0x4ed67584
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x4edd46a4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed674df
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4ed674eb
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x4ed6755c
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.4ed6852f
add esp, 0xc
jmp 0x4ed67548
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4ed67548
mov esi, dword [esi + 0x4edd46a4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x4ed6752d
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.4ecfd994
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ed6852f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4edda12c], ebx
push esi
push edi
jne 0x4ed685b1
push 0x4ec7141c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4ed685ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ed68684
push edi
call esi
test eax, eax
mov dword [0x4edda12c], eax
je 0x4ed685ec
push 0x4ed68674
push edi
call esi
push 0x4ed68660
push edi
mov dword [0x4edda130], eax
call esi
cmp dword [0x4edd114c], 2
mov dword [0x4edda134], eax
jne 0x4ed685b1
push 0x4ed68644
push edi
call esi
test eax, eax
mov dword [0x4edda13c], eax
je 0x4ed685b1
push 0x4ed6862c
push edi
call esi
mov dword [0x4edda138], eax
mov eax, dword [0x4edda138]
test eax, eax
je 0x4ed685f6
call eax
test eax, eax
je 0x4ed685dd
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4edda13c]
test eax, eax
je 0x4ed685dd
test byte [ebp - 8], 1
jne 0x4ed685f6
cmp dword [0x4edd1158], 4
jb 0x4ed685f0
or byte [ebp + 0x12], 0x20
jmp 0x4ed68615
xor eax, eax
jmp 0x4ed68625
or byte [ebp + 0x12], 4
jmp 0x4ed68615
mov eax, dword [0x4edda130]
test eax, eax
je 0x4ed68615
call eax
mov ebx, eax
test ebx, ebx
je 0x4ed68615
mov eax, dword [0x4edda134]
test eax, eax
je 0x4ed68615
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4edda12c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ed69981
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.4ec71104
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4ed699e7
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x4edd114c]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x4ed699eb
xor eax, eax
jmp 0x4ed699f8
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ed7cb04
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
cmp dword [0x4edd01d8], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
je 0x4ed7cb35
push dword [0x4edd2dcc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x4ed7cb46
push dword [0x4edd2dd0]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, esi
jne 0x4ed7cbb0
cmp dword [0x4edd01d8], esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 4
push esi
je 0x4ed7cb7d
push dword [0x4edd2dd4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4ed7cb8c
push dword [0x4edd2dd8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x4ed7cba7
cmp dword [ebp - 8], 4
jne 0x4ed7cba7
mov eax, dword [ebp - 0xc]
cmp eax, 0xfe
ja 0x4ed7cba7
mov dword [0x4edda1b0], eax
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4ed9b45b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0xc]
mov cl, byte [esi]
mov dx, word [esi + 0xe]
push edi
mov byte [ebp - 1], al
push 0x20
pop eax
sub eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov al, 1
shl al, cl
dec al
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
shr ebx, cl
mov cl, byte [esi]
and bl, al
xor eax, eax
inc eax
shl eax, cl
mov byte [ebp - 2], bl
cmp dx, ax
jne 0x4ed9b4b7
push edx
mov ecx, esi
call fcn.4ed9b34d
mov ecx, esi
call fcn.4ed97906
movzx dx, bl
jmp 0x4ed9b559
mov cl, byte [ebp - 1]
movzx eax, bl
mov ebx, eax
movzx edi, dx
shl eax, cl
shl ebx, 0xc
add ebx, edi
xor eax, edi
lea edi, [esi + eax*2 + 0x4020]
mov ax, word [edi]
jmp 0x4ed9b4f1
movzx ecx, ax
mov ecx, dword [esi + ecx*4 + 0x20]
mov dword [ebp - 0xc], ecx
and ecx, 0xfffff
cmp ebx, ecx
je 0x4ed9b534
mov eax, dword [ebp - 0xc]
shr eax, 0x14
test ax, ax
jne 0x4ed9b4d7
push edx
mov ecx, esi
call fcn.4ed9b34d
xor eax, eax
mov ax, word [esi + 2]
cmp ax, 0xfff
jae 0x4ed9b538
movzx ecx, word [edi]
inc eax
movzx edx, ax
shl ecx, 0x14
add ecx, ebx
mov dword [esi + edx*4 + 0x20], ecx
mov word [edi], ax
mov cl, byte [esi + 1]
mov word [esi + 2], ax
xor eax, eax
inc eax
shl eax, cl
cmp edx, eax
jl 0x4ed9b554
inc cl
mov byte [esi + 1], cl
jmp 0x4ed9b554
mov edx, eax
jmp 0x4ed9b559
cmp byte [esi + 0xd], 0
jne 0x4ed9b554
mov cl, byte [esi]
xor eax, eax
inc eax
shl eax, cl
mov ecx, esi
push eax
call fcn.4ed9b34d
mov ecx, esi
call fcn.4ed97906
movzx dx, byte [ebp - 2]
mov ecx, dword [ebp + 0xc]
sub dword [ebp + 0x10], ecx
cmp dword [ebp + 0x10], ecx
jl 0x4ed9b56f
shl dword [ebp + 8], cl
mov al, byte [ebp - 3]
jmp 0x4ed9b486
pop edi
mov word [esi + 0xe], dx
pop esi
mov al, 1
pop ebx
leave
ret 0xc

Function at 0x4eda31a3
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
xor ecx, ecx
cmp dword [esi + 0xc], ecx
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], ebx
je 0x4eda31ca
mov dl, byte [esi + 0x1c]
mov byte [ebx], dl
cmp dword [ebp + 0x10], ecx
jne 0x4eda31f2
push 0xc
push esi
mov dx, 0x10
call fcn.4eda2e11
push 0xc
push esi
mov dx, 0x10
call fcn.4eda2e11
cmp dword [esi + 0xc], 0
je 0x4eda324b
inc dword [esi + 0x18]
jmp 0x4eda324b
cmp dword [esi + 0x14], eax
jne 0x4eda3206
push 0xc
push esi
mov dx, 0x10
mov dword [esi + 0x14], ecx
call fcn.4eda2e11
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov eax, edi
call fcn.4eda2ca1
test eax, eax
jle 0x4eda3231
mov ebx, eax
push dword [ebp - 4]
movzx eax, word [edi]
push esi
call fcn.4eda2e74
xor dword [ebp - 4], 1
inc edi
inc edi
dec ebx
jne 0x4eda3219
mov ebx, dword [ebp + 0xc]
push 0xc
push esi
mov dx, 0x10
call fcn.4eda2e11
cmp dword [esi + 0xc], 0
je 0x4eda324b
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x1c], al
mov eax, dword [esi + 0x18]
pop edi
pop esi
sub eax, ebx
pop ebx
leave
ret 0xc
Function at 0x4eda325c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi + 4]
push edi
mov edi, dword [esi + 0x20]
xor ebx, ebx
mov eax, edi
inc ebx
call fcn.4eda2ca1
mov ecx, dword [ebp + 0xc]
and dword [esi + 0xc], 0
test eax, eax
mov dword [esi + 0x18], ecx
jle 0x4eda329f
mov dword [ebp + 8], eax
movzx eax, word [edi]
push ebx
push esi
call fcn.4eda2e74
inc edi
inc edi
xor ebx, 1
dec dword [ebp + 8]
jne 0x4eda328b
cmp dword [esi + 0xc], 0
je 0x4eda32a8
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4edb0d2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebx + 0x24]
push esi
mov dword [ebp - 0xc], eax
push edi
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub ecx, edx
sub ecx, esi
mov dword [ebp - 4], ecx
jne 0x4edb0d5c
test edx, edx
jne 0x4edb0d6b
test esi, esi
jne 0x4edb0d6b
mov ecx, eax
jmp 0x4edb0deb
cmp ecx, 0xffffffff
jne 0x4edb0d6b
mov ecx, 0xfffffffe
jmp 0x4edb0deb
mov esi, dword [ebx + 0x24]
lea esi, [eax + esi - 0x106]
cmp edx, esi
jb 0x4edb0deb
mov edi, dword [ebx + 0x30]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea esi, [eax + edi]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x68]
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x54]
sub esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebx + 0x68], esi
mov esi, dword [ebx + 0x44]
mov dword [ebx + 0x54], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 0x64], edx
lea edx, [ecx + esi*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x4edb0dbf
sub ecx, eax
jmp 0x4edb0dc1
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x4edb0db0
mov edx, dword [ebx + 0x38]
mov esi, eax
lea edx, [edx + eax*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x4edb0dde
sub ecx, eax
jmp 0x4edb0de0
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x4edb0dcf
mov ecx, dword [ebp - 4]
add ecx, eax
mov esi, dword [ebx]
mov edx, dword [esi + 4]
test edx, edx
mov dword [ebp - 0x14], esi
je 0x4edb0eb4
mov edi, dword [ebx + 0x64]
mov edx, dword [ebx + 0x6c]
add edx, edi
add edx, dword [ebx + 0x30]
mov edi, dword [esi + 4]
cmp edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
jbe 0x4edb0e1b
mov dword [ebp - 4], ecx
mov edi, ecx
test edi, edi
jne 0x4edb0e23
xor edx, edx
jmp 0x4edb0e70
mov ecx, dword [ebp - 8]
sub ecx, edi
mov dword [esi + 4], ecx
mov ecx, dword [esi + 0x1c]
cmp dword [ecx + 0x18], 0
jne 0x4edb0e48
mov edx, dword [esi]
mov ecx, dword [esi + 0x30]
push edi
call fcn.4edb25ad
mov edx, dword [ebp - 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [esi]
mov ecx, edi
mov edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx]
mov esi, dword [ecx + 8]
add edi, edx
add esi, edx
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov esi, dword [ebx + 0x6c]
add esi, edx
mov edi, esi
cmp edi, 3
mov dword [ebx + 0x6c], esi
jb 0x4edb0e9f
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
lea esi, [ecx + edx]
movzx edx, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], edx
shl edx, cl
movzx ecx, byte [esi + 1]
xor edx, ecx
and edx, dword [ebx + 0x4c]
mov dword [ebx + 0x40], edx
cmp edi, 0x106
jae 0x4edb0eb4
mov edx, dword [ebx]
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x4edb0d3b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4edb2078
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test edx, edx
jne 0x4edb2087
xor eax, eax
pop ebp
ret 4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 8
not ecx
mov esi, ecx
jb 0x4edb217c
mov ecx, edi
shr ecx, 3
xor ebx, ebx
mov bl, byte [edx]
mov eax, esi
shr eax, 8
sub edi, 8
xor ebx, esi
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
xor ebx, ebx
mov bl, byte [edx + 1]
xor eax, esi
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
xor ebx, ebx
mov bl, byte [edx + 1]
shr eax, 8
xor eax, esi
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
xor ebx, ebx
mov bl, byte [edx + 1]
shr eax, 8
xor eax, esi
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
xor ebx, ebx
mov bl, byte [edx + 1]
shr eax, 8
xor eax, esi
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
shr eax, 8
xor eax, esi
xor ebx, ebx
mov bl, byte [edx + 1]
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
shr eax, 8
xor eax, esi
xor ebx, ebx
mov bl, byte [edx + 1]
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
shr eax, 8
xor eax, esi
xor ebx, ebx
mov bl, byte [edx + 1]
inc edx
xor ebx, eax
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4edb21a8]
shr eax, 8
xor eax, esi
inc edx
dec ecx
mov esi, eax
jne 0x4edb209f
test edi, edi
je 0x4edb219b
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, 0xff
mov ebx, dword [eax*4 + 0x4edb21a8]
shr esi, 8
xor esi, ebx
inc edx
dec edi
jne 0x4edb2180
pop edi
mov eax, esi
pop esi
not eax
pop ebx
pop ebp
ret 4