joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478840
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov ebx, ecx
lea esi, [edx + 1]
push edi
mov dword [ebp - 0x24], ebx
xor edi, edi
nop word [eax + eax]
movzx edx, byte [esi - 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 3]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 2]
shl edx, 8
or edx, eax
mov dword [ebp + edi*4 - 0x128], edx
inc edi
cmp edi, 0x10
jb 0x478860
cmp edi, 0x40
jae 0x4788df
mov ebx, 0x40
lea eax, [ebp + edi*4 - 0x130]
sub ebx, edi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x4788a2
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x28], eax
mov edi, eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x6c]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
nop dword [eax]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, edi
add esi, ecx
rol eax, 0xa
add esi, dword [edx + 0x5a5748]
add esi, dword [ebp + edx - 0x128]
mov edx, edi
add esi, dword [ebp - 0x1c]
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x20]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], edx
cmp edx, 0x100
jb 0x478920
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x24]
pop edi
pop esi
add dword [ebx + 0x54], ecx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x58], eax
mov eax, dword [ebp - 0x14]
add dword [ebx + 0x5c], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x60], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x64], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x6c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4796f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x2c], 0
mov esi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 8], esi
cmp dword [edi + 0x14], 0x10
jb 0x479717
mov eax, dword [edi]
jmp 0x479719
mov eax, edi
push dword [edi + 0x10]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
push eax
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.00405ff0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x479848
cmp dword [eax + 0x14], 0x10
jb 0x479753
mov eax, dword [eax]
mov dword [ebp + 8], eax
xor bh, bh
xor eax, eax
nop word [eax + eax]
mov byte [ebp + eax - 0x134], al
inc eax
cmp eax, 0x100
jb 0x479760
mov edi, dword [ebp + 8]
xor esi, esi
mov word [ebp - 0x34], 0
nop word [eax + eax]
mov eax, esi
mov bl, byte [ebp + esi - 0x134]
xor edx, edx
div ecx
lea ecx, [ebp - 0x134]
movzx eax, byte [edx + edi]
add al, bl
add bh, al
movzx eax, bh
add ecx, eax
movzx eax, byte [ecx]
mov byte [ebp + esi - 0x134], al
inc esi
mov byte [ecx], bl
mov ecx, dword [ebp - 0x24]
cmp esi, 0x100
jb 0x479780
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x20]
cmp dword [ebp - 0xc], 0x10
cmovae ebx, dword [ebp - 0x20]
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x4797d1
mov edi, dword [edi]
mov esi, dword [ebp - 8]
test eax, eax
je 0x479848
mov dl, byte [ebp - 0x34]
sub edi, ebx
mov esi, eax
nop
inc dl
lea ebx, [ebx + 1]
mov byte [ebp - 0x34], dl
movzx eax, dl
lea edx, [ebp - 0x134]
add edx, eax
mov al, byte [ebp - 0x33]
add al, byte [edx]
mov byte [ebp - 0x33], al
mov cl, byte [edx]
movzx eax, al
movzx eax, byte [ebp + eax - 0x134]
mov byte [edx], al
movzx eax, byte [ebp - 0x33]
mov byte [ebp + eax - 0x134], cl
movzx ecx, byte [ebp - 0x33]
mov dl, byte [ebp - 0x34]
movzx eax, dl
movzx ecx, byte [ebp + ecx - 0x134]
add cl, byte [ebp + eax - 0x134]
movzx eax, cl
movzx eax, byte [ebp + eax - 0x134]
xor al, byte [edi + ebx - 1]
mov byte [ebx - 1], al
sub esi, 1
jne 0x4797e0
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x20]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00406450
mov eax, dword [ebp - 0xc]
cmp eax, 0x10
jb 0x479879
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.00406640
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479970
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570ee9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
push esi
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx], 0
mov dword [ebp - 4], 0
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test edi, edi
je 0x479b40
nop dword [eax]
mov al, byte [edx]
dec edi
mov byte [ebp + esi - 0x14], al
inc edx
mov ch, byte [ebp - 0x12]
inc esi
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xe], ch
mov byte [ebp + 0xb], ah
mov byte [ebp - 0xd], cl
cmp esi, 3
jne 0x479a6a
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, ah
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop word [eax + eax]
cmp dword [0x75f6c4], 0x10
mov ecx, 0x75f6b0
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x75f6b0]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.00413800
inc esi
cmp esi, 4
jl 0x479a30
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ah, byte [ebp + 0xb]
mov cl, byte [ebp - 0xd]
mov ch, byte [ebp - 0xe]
test edi, edi
jne 0x4799d0
mov dword [ebp + 8], esi
test esi, esi
je 0x479b40
mov edi, 3
cmp esi, edi
jge 0x479aad
mov ecx, edi
xor eax, eax
sub ecx, esi
lea edi, [ebp - 0x14]
mov edx, ecx
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ch, byte [ebp - 0x12]
mov edi, 3
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shr al, 4
and ah, 0xf
shl cl, 4
add cl, al
shl ah, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add ah, al
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x16], ah
lea eax, [esi + 1]
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x479b23
xor edi, edi
mov esi, eax
nop dword [eax]
cmp dword [0x75f6c4], 0x10
mov ecx, 0x75f6b0
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x75f6b0]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.00413800
inc edi
cmp edi, esi
jl 0x479af0
mov esi, dword [ebp + 8]
mov edi, 3
cmp esi, 3
jge 0x479b40
sub edi, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, ebx
call fcn.00413800
sub edi, 1
jne 0x479b30
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47d3f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x40
push esi
push edi
mov esi, 0x5acb00
mov byte [ebp - 1], 0
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x10]
xor esi, esi
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div edi
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x47d430
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d480
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x200]
sub edx, eax
mov bh, byte [edi + 0x208]
add ecx, eax
sub esi, eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0x10], esi
cmp eax, ecx
jae 0x47d4e8
sub edx, esi
mov dword [ebp + 0xc], edx
movzx esi, al
mov bl, byte [esi + edi]
add bh, bl
movzx edx, bh
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
mov byte [edx + edi], bl
movzx ecx, byte [esi + edi]
mov edx, dword [ebp + 0x10]
add cl, bl
mov esi, dword [ebp + 0xc]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + edi]
xor cl, byte [esi + edx]
mov byte [edx], cl
cmp eax, dword [ebp + 8]
jb 0x47d4b3
mov byte [edi + 0x208], bh
mov dword [edi + 0x200], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x47d500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
mov bh, byte [edi + 0x209]
add ecx, eax
mov dword [ebp - 4], esi
sub edx, eax
mov esi, dword [ebp + 0x10]
sub esi, eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x10], esi
cmp eax, ecx
jae 0x47d57a
sub edx, esi
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx esi, al
add esi, edx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 0x10]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp + 0x14]
jb 0x47d540
mov edi, dword [ebp + 8]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484f3e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x484f46
mov dword [edx*4 + 0x75fd60], ecx
inc edx
cmp edx, 0x100
jb 0x484f41
mov esi, 0x800
jmp 0x484f8f
mov ecx, dword [edx*4 + 0x75f960]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x75fd60]
mov dword [edx*4 + 0x75fd60], ecx
inc edx
cmp edx, esi
jb 0x484f73
mov dword [0x74b930], 0x485c59
call fcn.00485ad2
mov ecx, dword [0x74b930]
test eax, eax
mov edx, 0x485cf2
cmove ecx, edx
mov dword [0x74b930], ecx
pop esi
ret

Function at 0x485fb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x485fd3
xor eax, eax
jmp 0x486128
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
mov edx, dword [ebp + 8]
push ebx
or ebx, 0xffffffff
add ecx, edx
mov dword [ebp - 8], ecx
add edx, edi
mov dword [ebp - 4], edx
cmp edx, ecx
jae 0x485fff
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x485ffc
inc edx
cmp edx, ecx
jb 0x485fef
mov dword [ebp - 4], edx
mov edi, edx
sub edi, dword [ebp + 8]
cmp edx, ecx
jae 0x48610c
mov ecx, edi
sub ecx, ebx
cmp ecx, 3
jbe 0x486037
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test al, al
je 0x486074
cmp al, 0xff
je 0x486074
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x486105
dec ecx
shl esi, cl
and esi, 7
je 0x486017
movzx eax, byte [esi + 0x578058]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x578050], 0
mov al, byte [ecx + 4]
je 0x48605e
test al, al
je 0x48605e
cmp al, 0xff
jne 0x486017
and esi, 3
mov ebx, edi
add esi, esi
or esi, 1
inc edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
jmp 0x485fe6
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 0x10]
shl ebx, 8
or ebx, eax
cmp dword [ebp + 0x18], 0
je 0x4860a1
add ebx, edi
add ebx, edx
jmp 0x4860a5
sub ebx, edi
sub ebx, edx
mov dword [ebp + 0xc], ebx
test esi, esi
je 0x4860db
movzx eax, byte [esi + 0x578058]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x4860ca
cmp al, 0xff
jne 0x4860db
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0xc]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp + 0xc]
jmp 0x486095
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x486069
mov edx, edi
xor eax, eax
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48bd76
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x48bddd
push esi
call fcn.0048c059
pop ecx
test al, al
jne 0x48bddd
push ebx
push edi
lea eax, [ebp + 8]
push eax
push esi
call fcn.0048bff8
pop ecx
mov esi, eax
mov ebx, 0x1505
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
and dword [ebp + 8], 0
add ecx, esi
mov edi, ecx
sub edi, esi
cmp esi, ecx
cmova edi, eax
test edi, edi
je 0x48bdd6
mov al, byte [esi]
push eax
call fcn.004a40cd
imul ebx, ebx, 0x21
pop ecx
movsx ecx, al
mov eax, dword [ebp + 8]
xor ebx, ecx
inc esi
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x48bdb9
pop edi
movzx eax, bl
pop ebx
jmp 0x48bddf
xor eax, eax
pop esi
pop ebp
ret

Function at 0x48caf1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x48cb12
cmp dword [esi + 0x8c], 0
je 0x48cb12
push 2
push 3
push esi
call fcn.004a4877
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0049a0a2
pop ecx
test esi, esi
je 0x48cb32
cmp dword [esi + 0x8c], 0
je 0x48cb32
push 3
push esi
call fcn.004a48b2
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x494d23
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x608], edi
je 0x494d62
push 1
push esi
call fcn.0048877e
push dword [esi + 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [esi + 0x608]
push 0
push esi
mov edi, eax
call fcn.0048877e
add esp, 0x24
jmp 0x494d98
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x494d98
push dword [esi + 0x598]
imul eax, eax, 3
push 1
push 2
add eax, 0x579324
push eax
call fcn.0051d8bb
push dword [esi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0051d8bb
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x496cfc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00537c18
Function at 0x4a4e7f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.005316d8
add esp, 0x18
test eax, eax
je 0x4a4e9f
cmp eax, 0xffffffff
jne 0x4a4ea1
xor eax, eax
pop ebp
ret

Function at 0x4b47ba
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x4b47e6
push str.Couldnt_set_desired_mode
push edx
call fcn.00494d9e
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x4b483a
cmp ecx, 0xc8
je 0x4b47fd
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.00494e74
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4b480e
push edi
call fcn.004b4567
pop ecx
jmp 0x4b4836
cmp eax, 0x14
jne 0x4b481b
push edi
call fcn.004b3713
jmp 0x4b480b
cmp eax, 0x15
jne 0x4b4824
push 0xd
jmp 0x4b482b
cmp eax, 0x16
jne 0x4b4838
push 0xe
push 1
push edi
call fcn.004b4162
add esp, 0xc
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x4c25c6
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x5bd0cc]
mov edi, eax
pop ecx
test edi, edi
je 0x4c26b2
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4c262f
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4c2635
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x4c26aa
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
sub ebx, 1
jne 0x4c264f
mov ebx, dword [ebp - 8]
jmp 0x4c26aa
push 1
push 0x5833ef
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x5833f0
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x4c268c
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4de310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x576bb0
push dword [ebp + 8]
call fcn.0051e54e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4de36d
push ebx
push edi
push esi
call fcn.0051d65d
push eax
call fcn.0053225d
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x4de34c
push 0x7a
call dword [0x575204]
xor ebx, ebx
jmp 0x4de362
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0051e021
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.0051d2f7
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x4e2b46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
xor eax, eax
cmp ax, bx
jge 0x4e2bec
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
inc edx
mov eax, dword [edi]
push 0
push ecx
push edx
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x4e2bb4
mov ecx, edi
call fcn.004e3ecf
mov ecx, dword [ebp - 4]
inc esi
push 1
pop edx
cmp si, bx
jl 0x4e2b8f
cmp si, bx
jge 0x4e2bec
push dword [ebp + 0x14]
or eax, 0xffffffff
mov ecx, ebx
push dword [ebp + 0x10]
sub ecx, esi
cmp word [ebp + 0xc], 0
push 1
pop edx
cmovg eax, edx
movsx ecx, cx
cwde
imul ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.004caf45
test bx, bx
je 0x4e2c2b
mov ecx, edi
call fcn.004c8e4a
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [0x57564c]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ecc9f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x4eccc2
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x4ecd5f
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.004ec8b5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4ecce5
push ebx
call fcn.0051d2f7
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x4ecd3b
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x5bd2b4]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x4ecd10
call fcn.0051d2f7
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x4ecd3b
push esi
push 1
push eax
call fcn.0051e021
push ebx
mov esi, eax
call fcn.0051d2f7
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x4ecd44
push dword [ebp - 4]
call dword [0x5bd2b8]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x4ecd5e
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.004ecc4a
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f4624
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0xc
pop edi
mov eax, dword [esi]
sub eax, edi
mov dword [ebp - 4], ebx
push eax
call fcn.004824ab
mov dword [ebp + 0xc], eax
pop ecx
test eax, eax
je 0x4f469a
cmp dword [esi], edi
jbe 0x4f4684
movzx eax, word [ebx + 0x18]
mov ecx, dword [ebp - 4]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr ebx, 8
xor bl, byte [eax + edi]
mov byte [ebp - 8], bl
push dword [ebp - 8]
call fcn.004f47b7
mov eax, dword [ebp + 0xc]
mov byte [eax + edi - 0xc], bl
inc edi
mov ebx, dword [ebp - 4]
cmp edi, dword [esi]
jb 0x4f464d
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00482276
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
xor eax, eax
add dword [esi], 0xfffffff4
inc eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8