joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d660
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push ecx
mov dword [ecx + 0x34], 0
mov byte [ecx + 0x1f], 0
mov dword [ecx + 0x24], 0
call fcn.0046dbf0
xor edx, edx
lea esi, [ecx + 0x60]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
dec ecx
shr eax, 1
not ecx
inc edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x46d684
pop esi
pop ebp
ret 4

Function at 0x473b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x100
or esi, edi
mov eax, esi
add ebx, ebx
shr eax, 7
mov ecx, edi
and eax, 1
and ecx, ebx
push eax
mov eax, esi
add ecx, edi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ecx + eax*2]
push eax
push dword [ebp + 8]
call fcn.004751a0
add esi, esi
mov eax, esi
xor eax, ebx
not eax
and edi, eax
cmp esi, 0x10000
jb 0x473b33
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x473b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
or ecx, 0x100
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 8
movzx esi, word [edx + eax*2]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr esi, 4
neg edx
sar edx, 4
and edx, 0x7f
xor esi, edx
add edi, dword [ebx + esi*4]
cmp ecx, 0x10000
jb 0x473b94
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x473bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor edx, eax
mov eax, dword [ebp + 0x14]
add ebx, dword [eax + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x473be5
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x475360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 1
shl eax, cl
mov ecx, dword [ebp + 0x10]
push edi
or ecx, eax
xor edi, edi
cmp ecx, 1
je 0x4753a6
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
and ecx, 1
shr esi, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx edx, word [ebx + esi*2]
shr edx, 4
xor edx, ecx
mov ecx, esi
add edi, dword [eax + edx*4]
cmp ecx, 1
jne 0x475382
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret 0x10

Function at 0x4753f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [eax + 1]
cmp dword [ebp + 0xc], eax
je 0x475432
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edx, dword [ebp + 8]
mov edi, ebx
and edi, 1
shr ebx, 1
movzx esi, word [edx + ecx*2]
mov edx, edi
neg edx
shr esi, 4
sar edx, 4
add ecx, ecx
and edx, 0x7f
or ecx, edi
xor esi, edx
mov edx, dword [ebp + 0x14]
add eax, dword [edx + esi*4]
dec dword [ebp + 0xc]
jne 0x475403
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x47a1e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
pop ebp
ret 4

Function at 0x47a3d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
pop ebp
ret 4

Function at 0x47b4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0066da1a
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.0047b3d0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4824a6
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x6a6a32
call fcn.0066edc8
cmp byte [0x781cbc], 0
mov edi, dword [ebp + 8]
jne 0x4824e6
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.004800bd
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00480130
pop ecx
test esi, esi
je 0x4824f4
mov al, 1
jmp 0x482539
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x4824e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x482505
xor al, al
jmp 0x482539
lea ecx, [ebp - 0x50]
call fcn.00482dae
lea ecx, [ebp - 0x28]
call fcn.0047f0c1
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00482fdd
test al, al
je 0x48252e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00480130
pop ecx
mov al, bl
call fcn.0066ed96
ret 4

Function at 0x482541
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x781cbc], 0
jne 0x48257b
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
pop ecx
test esi, esi
pop esi
je 0x48258a
mov al, 1
jmp 0x48258c
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x482575
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x482779
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00483687
cmp eax, 0xffffffff
je 0x4827a4
test al, 0x10
jne 0x4827a4
test al, 1
je 0x4827a4
and eax, 0xfffffffe
push eax
push esi
call fcn.00482cda
test al, al
je 0x4827dc
cmp byte [0x781cbc], 0
push esi
jne 0x4827d2
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
pop ecx
test esi, esi
je 0x4827dc
mov al, 1
jmp 0x4827de
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x4827cc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x482a4d
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x781cbc], 0
jne 0x482a85
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
pop ecx
test esi, esi
pop esi
je 0x482a92
mov al, 1
jmp 0x482a94
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x482a7f
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x482c2e
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x781cbc], 0
jne 0x482c65
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
test esi, esi
pop ecx
setne al
pop esi
jmp 0x482c74
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x482cda
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x781cbc], 0
jne 0x482d15
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
pop ecx
test esi, esi
pop esi
je 0x482d25
mov al, 1
jmp 0x482d27
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x482d0f
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x483687
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x781cbc], 0
jne 0x4836bb
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004800bd
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00480130
pop ecx
mov eax, esi
pop esi
jmp 0x4836ce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x483769
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x6a6bd2
call fcn.0066edc8
mov ecx, dword [ebp + 8]
call fcn.004979a5
cmp byte [0x781cbc], 0
jne 0x483847
mov ecx, dword [ebp + 8]
call fcn.004979a5
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x4837ac
xor al, al
jmp 0x4838fa
push edi
call fcn.00480108
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
test edi, edi
je 0x4838f1
cmp edi, dword [ebp - 0x18]
ja 0x4838f1
lea ecx, [ebp - 0x2c]
call fcn.0047ef2a
mov byte [ebp - 4], 1
test edi, edi
je 0x48383d
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x483833
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0047f158
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00480095
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.0047e436
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00480130
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
dec ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x4837f1
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x4838e8
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x4837a5
push edi
lea ecx, [ebp - 0x1c]
call fcn.00482d2d
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x4838f1
cmp edi, dword [ebp - 0x18]
ja 0x4838f1
lea ecx, [ebp - 0x38]
call fcn.0047f0c1
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x4838e3
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x4838d2
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.0047f20b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0047e436
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x4838a4
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.00480130
pop ecx
push esi
call fcn.00480130
mov al, bl
pop ecx
call fcn.0066ed96
ret 4
Function at 0x483d6e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 4], 0
je 0x483d90
cmp byte [ecx + 5], 0
je 0x483d90
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 4], eax
mov al, 1
jmp 0x483dc7
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x483db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x483db2
xor al, al
jmp 0x483dc6
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x491920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x200
jb 0x491982
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x491982
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x491982
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x491982
test cl, 7
jne 0x491982
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x491982
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x49199d
sub eax, 0x74
je 0x491996
dec eax
dec eax
je 0x491996
dec eax
dec eax
je 0x49198f
sub eax, 0x3c
je 0x491988
sub eax, 0x8464
je 0x49199d
xor eax, eax
pop ebp
ret 0xc
mov edx, 0x3030401
jmp 0x4919a2
mov edx, 0x3030701
jmp 0x4919a2
mov edx, 0x3030501
jmp 0x4919a2
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x491982
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4919bf
cmp eax, 0x20b
jne 0x491982
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x491984

Function at 0x494fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 8
jb 0x494ff8
push edi
mov edi, esi
shr edi, 3
mov eax, dword [ecx + 4]
sub esi, 8
xor eax, dword [ecx]
add ecx, 8
xor edx, eax
dec edi
jne 0x494fe7
pop edi
cmp esi, 4
jb 0x495002
xor edx, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x495013
movzx eax, byte [ecx]
shl eax, 0x10
xor edx, eax
inc ecx
cmp esi, 1
jbe 0x495021
movzx eax, byte [ecx]
shl eax, 8
xor edx, eax
inc ecx
test esi, esi
pop esi
je 0x49502b
movzx ecx, byte [ecx]
xor edx, ecx
mov eax, edx
pop ebp
ret 8
Function at 0x4ac653
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x4ac6cb
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.0047f10a
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
call fcn.004ac9b6
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x4ac6d4
mov ecx, esi
call fcn.004aaf38
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x4ac701
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x24], cl
je 0x4ac701
or word [esi], 1
jmp 0x4ac726
mov eax, 0xfffe
and word [esi], ax
test bl, bl
je 0x4ac726
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x1c], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4af734
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4af742
and dword [esi], 0
mov ecx, dword [ebp + 0x10]
xor eax, eax
inc eax
test ecx, ecx
je 0x4af782
mov eax, 0x8000
cmp ecx, eax
push 0
cmovb eax, ecx
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], 0
test esi, esi
je 0x4af782
add dword [esi], edx
test eax, eax
setne al
movzx eax, al
push eax
call fcn.004aefca
pop esi
pop ebp
ret 0x10

Function at 0x4b5a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
mov byte [edi + 0x7049], 0
mov dword [ebx], 0
mov ecx, edi
call fcn.004b5a50
mov byte [ebp + esi - 0x10], al
inc esi
cmp esi, 0xa
jb 0x4b5aa7
mov eax, dword [edi + 0x168]
cmp eax, 4
ja 0x4b5b5e
mov ecx, 0x20
shl eax, 3
sub ecx, dword [edi + 0x140]
cmp ecx, eax
jb 0x4b5b5e
movzx ecx, byte [ebp - 0xa]
movzx eax, byte [ebp - 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 7]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebx], ecx
call fcn.004b5420
test al, al
je 0x4b5b37
mov byte [edi + 0x7048], 1
mov eax, dword [edi + 0x6ffc]
rol eax, 1
xor eax, dword [ebx]
mov dword [edi + 0x6ffc], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
call fcn.004b5460
test al, al
je 0x4b5b5e
mov word [edi + 0x7048], 0x101
mov eax, dword [ebx]
cmp eax, dword [edi + 0x6ffc]
je 0x4b5b22
mov byte [edi + 0x704a], 1
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], 0
push edi
mov dword [ebp - 0x14], 8
mov byte [ebp - 0x10], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x8ce0]
mov dword [esi + 0x8cd4], 0
push dword [eax + 0x174]
push dword [ebp + 8]
push dword [esi]
call fcn.004b6830
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x1a0], 0
je 0x4b6a94
imul ecx, dword [esi + 0x8cd8], 0x8e00
mov eax, dword [eax + 0x17c]
push dword [ecx + eax + 0x8cf0]
call fcn.0047b3f0
xor edx, edx
cmp dword [esi + 0x8cd4], edx
jbe 0x4b6ac7
lea edi, [esi + 0x7cd4]
mov ecx, dword [esi + 0x8ce0]
lea edi, [edi + 4]
inc edx
mov eax, dword [ecx + 0x178]
rol eax, 1
xor eax, dword [edi - 4]
mov dword [ecx + 0x178], eax
cmp edx, dword [esi + 0x8cd4]
jb 0x4b6aa4
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x10]
mov ecx, dword [esi + 0x8ce0]
lea eax, [eax*8 + 8]
sub eax, dword [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.004b7e30
mov ebx, dword [esi + 0x8ce0]
xor eax, eax
cmp byte [ebx + 0x1a0], al
je 0x4b6b7d
mov edi, dword [esi + 0x8cd8]
inc edi
cmp edi, dword [ebx + 0x19c]
cmove edi, eax
cmp dword [ebx + 0x1b4], eax
je 0x4b6b59
lea ecx, [ebx + 0x148]
call fcn.004b1ed7
mov ecx, eax
mov eax, 0xf
sub eax, dword [ebx + 0x140]
shr eax, 3
add ecx, eax
mov eax, dword [esi + 0x8ce0]
mov dword [ebp - 8], ecx
adc edx, 0
mov dword [ebp - 4], edx
mov ecx, dword [eax + 0x1b4]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x8cf8]
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov ebx, eax
jmp 0x4b6b5b
xor ebx, ebx
mov ecx, dword [esi + 0x8ce0]
imul edx, edi, 0x8e00
mov ecx, dword [ecx + 0x17c]
add ecx, 0x8cf0
add ecx, edx
push ecx
call fcn.0047b360
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b7450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
push 0x31
mov dword [ebp - 4], ebx
call fcn.004b7df0
push 0x41
mov ecx, ebx
call fcn.004b7df0
push 0x59
mov ecx, ebx
call fcn.004b7df0
push 0x26
mov ecx, ebx
call fcn.004b7df0
push 0x53
mov ecx, ebx
call fcn.004b7df0
push 0x59
mov ecx, ebx
call fcn.004b7df0
mov eax, dword [ebp + 8]
or esi, 0xffffffff
xor edi, edi
xor ebx, ebx
mov dh, byte [eax]
lea esp, [esp]
mov dl, byte [ebx + eax]
cmp edi, 4
jne 0x4b74c9
test dl, dl
je 0x4b74c5
movzx ecx, dh
nop
mov eax, esi
shl esi, 8
shr eax, 0x18
xor eax, ecx
xor esi, dword [eax*4 + 0x781400]
dec dl
jne 0x4b74b0
xor edi, edi
jmp 0x4b74eb
cmp dh, dl
jne 0x4b74d0
inc edi
jmp 0x4b74d7
mov edi, 1
mov dh, dl
mov ecx, esi
movzx eax, dl
shr ecx, 0x18
xor ecx, eax
shl esi, 8
xor esi, dword [ecx*4 + 0x781400]
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x4b74a0
mov ecx, dword [ebp - 4]
not esi
push esi
call fcn.004b7f00
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
call fcn.004b6b90
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c24e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push edi
push 5
mov ebx, ecx
push eax
push ebx
call fcn.00479760
push 5
lea ecx, [ebp - 0x84]
lea eax, [ebx + 0x60]
push ecx
push eax
call fcn.00479760
mov eax, dword [esi]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x34], eax
test edi, edi
je 0x4c2585
lea ecx, [ecx]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.004798a0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebx + 0x60]
push eax
call fcn.004798a0
mov eax, dword [ebp - 0x44]
xor dword [esi], eax
mov eax, dword [ebp - 0x40]
xor dword [esi + 4], eax
mov eax, dword [ebp - 0x3c]
xor dword [esi + 8], eax
mov eax, dword [ebp - 0x38]
xor dword [esi + 0xc], eax
mov eax, dword [ebp - 0x34]
xor dword [esi + 0x10], eax
dec edi
jne 0x4c2540
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8