joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f7d1
Capabilities:
Log keystrokes

Disassembly:
push 4
mov eax, 0x69a854
call fcn.0048a7b2
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x75d004]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
and dword [ebp - 4], 0
inc ebx
movzx edx, cx
mov dword [ebp - 0x10], ebx
push 2
pop edi
cmp edx, 0x25
ja 0x47f87a
je 0x47f870
mov eax, edx
sub eax, 0xd
je 0x47f866
sub eax, 0xe
je 0x47f85c
sub eax, 5
je 0x47f852
sub eax, ebx
je 0x47f848
sub eax, ebx
je 0x47f83e
sub eax, ebx
je 0x47f834
sub eax, ebx
jne 0x47f8b1
push str.Home
jmp 0x47f9f7
push 0x6acc2c
jmp 0x47f9f7
push str.PageDown
jmp 0x47f9f7
push str.PageUp
jmp 0x47f9f7
push str.Space
jmp 0x47f9f7
push 0x6acbe0
jmp 0x47f9f7
push 0x6acbe8
jmp 0x47f9f7
push str.Left
jmp 0x47f9f7
mov eax, edx
sub eax, 0x26
je 0x47f9f2
sub eax, 1
je 0x47f9eb
sub eax, 1
je 0x47f9e4
sub eax, edi
je 0x47f9dd
sub eax, 3
je 0x47f9d6
sub eax, 1
je 0x47f9cf
cmp cx, 0x30
jb 0x47f8bd
cmp cx, 0x39
jbe 0x47f8c6
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x47f8dd
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.00407cd0
jmp 0x47f9fe
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x47f901
lea eax, [edx - 0x60]
push eax
push str.Num__d
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004078d0
add esp, 0x10
mov dword [ebp - 4], ebx
jmp 0x47f953
cmp cx, 0x6a
jne 0x47f911
push 0x6acc90
jmp 0x47f9f7
cmp cx, 0x6b
jne 0x47f921
push str.Num_
jmp 0x47f9f7
cmp cx, 0x6e
jne 0x47f931
push str.Num_Del
jmp 0x47f9f7
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x47f96f
lea eax, [edx - 0x6f]
push eax
push 0x6accb8
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004078d0
add esp, 0x10
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x47f9fe
call fcn.004025b0
jmp 0x47f9fe
push edi
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, al
movsx eax, cl
cmp eax, 0x3b
jg 0x47f99e
je 0x47f9b7
sub eax, 0x27
je 0x47f9b7
sub eax, 5
je 0x47f9b7
sub eax, 1
je 0x47f9b7
sub eax, 1
je 0x47f9b7
sub eax, 1
je 0x47f9b7
jmp 0x47f9fe
sub eax, 0x3d
je 0x47f9b7
sub eax, 0x1e
je 0x47f9b7
sub eax, 1
je 0x47f9b7
sub eax, 1
je 0x47f9b7
sub eax, 3
jne 0x47f9fe
movsx ax, cl
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.00432bdc
jmp 0x47f9fe
push str.Delete
jmp 0x47f9f7
push str.Insert
jmp 0x47f9f7
push str.Print
jmp 0x47f9f7
push str.Down
jmp 0x47f9f7
push str.Right
jmp 0x47f9f7
push 0x6acbf4
mov ecx, esi
call fcn.00407960
mov eax, esi
call fcn.0048a780
ret

Function at 0x486a79
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x486ae1
mov ecx, esi
call fcn.00486ae6
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x394]
test ecx, ecx
je 0x486abc
push 0
call fcn.00445305
and dword [esi + 0x394], 0
mov ecx, dword [0x769b84]
lea ecx, [ecx + 8]
call fcn.00434d21
mov ecx, dword [esi + 0x38c]
test ecx, ecx
je 0x486ae1
pop esi
mov ecx, dword [ecx + 0x174]
pop ebp
jmp fcn.004875f9
pop esi
pop ebp
ret 4
Function at 0x48b6a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48b6e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48b6e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48b6e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48b6e2
cmp dword [ecx + 0x74], 0xe
jbe 0x48b6e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x491c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x491cad
cmp eax, edi
jge 0x491c9d
push esi
call fcn.0048ed51
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
sub dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, eax
test eax, eax
jle 0x491cd2
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x491cb8
mov dword [esi + 8], edx
jmp 0x491ce7
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x491cdd
xor dl, dl
jmp 0x491ce2
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x491cd2
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x491d20
mov dword [0x76a2d0], str.zlib_corrupt
xor eax, eax
jmp 0x491d62
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x491d35
mov dword [0x76a2d0], str.read_past_buffer
jmp 0x491d1c
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x491d4c
push edi
push esi
call fcn.00494158
pop ecx
pop ecx
test eax, eax
je 0x491d1c
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0053f540
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x49dc2a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x76a432], 0
jne 0x49dcd9
push esi
push 0x6b0854
call fcn.004ac050
mov dword [esp], 0x6b0830
call fcn.004ac050
mov dword [esp], 0x6b0698
call fcn.004ac050
mov dword [esp], 0x6b06bc
call fcn.004ac050
mov dword [esp], 0x6b05d8
call fcn.004ac050
mov esi, 0x6b0790
push esi
call fcn.004bc926
push esi
call fcn.004bc926
push 0x6b07b0
call fcn.004bc926
push 0x6b07d0
call fcn.004bc926
push 0x6b0600
call fcn.004bc926
push 0x6b0750
call fcn.004bc926
push 0x6b0770
call fcn.004bc926
push 0x6b0640
call fcn.004bc926
push 0x6b0660
call fcn.004bc926
add esp, 0x28
mov byte [0x76a432], 1
pop esi
jmp 0x4c5bff
ret
xor ecx, ecx
push esi
push 8
mov edx, ecx
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x4c5c07
mov dword [ecx*4 + 0x782440], edx
inc ecx
cmp ecx, 0x100
jb 0x4c5c02
mov edx, 0x400
mov ecx, dword [edx + 0x782040]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x782440]
mov dword [edx + 0x782440], ecx
add edx, 4
cmp edx, 0x2000
jb 0x4c5c31
mov eax, 0x691f40
mov esi, 0x691e60
mov dword [0x784448], eax
mov dword [0x784440], eax
mov dword [0x784444], esi
call fcn.004e02b1
test eax, eax
jne 0x4c5c7e
mov dword [0x784440], esi
pop esi
ret

Function at 0x49eccc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 7
jbe 0x49ecda
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x49ece9
Capabilities:
Copy file
Delete file

Disassembly:
push 0x3c
mov eax, 0x69bdbf
call fcn.0048a7e5
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x49ed98
cmp dword [esi + 0x10], 0x104
ja 0x49ed98
push esi
call fcn.0049eccc
pop ecx
test al, al
jne 0x49ed1e
inc al
jmp 0x49ed9a
push esi
lea ecx, [ebp - 0x28]
call fcn.00407510
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
xor esi, esi
add eax, 2
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00410950
push 0x1e
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.0053fb70
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], esi
or eax, 0x414
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], 7
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], esi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
lea ecx, [ebp - 0x28]
sete bl
call fcn.00401db0
mov al, bl
jmp 0x49ed9a
xor al, al
call fcn.0048a794
ret
Function at 0x4a0b88
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa8], 5
jne 0x4a0baf
cmp dword [ebp + 0xc], 0
je 0x4a0baf
mov ecx, esi
call fcn.004a0a1a
mov eax, 0x80004005
jmp 0x4a0caf
xor ecx, ecx
push edi
cmp dword [esi + 0x64], ecx
jne 0x4a0bd3
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4a0cac
mov edx, dword [ecx]
lea eax, [esi + 0x24]
push eax
call dword [edx + 0x14]
jmp 0x4a0cac
cmp byte [esi + 0x74], cl
jne 0x4a0be8
cmp byte [esi + 0x80], cl
jne 0x4a0be8
cmp byte [esi + 0x8c], cl
je 0x4a0c4f
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 7
jbe 0x4a0bf3
mov eax, dword [eax]
push ecx
push 0x80
push 3
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a0c4f
xor edx, edx
lea ecx, [esi + 0x78]
cmp byte [esi + 0x74], dl
cmovne edx, ecx
xor eax, eax
cmp byte [esi + 0x80], al
lea ecx, [esi + 0x84]
push edx
cmovne eax, ecx
xor ecx, ecx
cmp byte [esi + 0x8c], cl
push eax
lea eax, [esi + 0x90]
cmovne ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x6d], 0
je 0x4a0c6a
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 7
jbe 0x4a0c60
mov eax, dword [eax]
push dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4a0cac
push dword [esi + 0xa4]
mov eax, dword [ecx]
lea edi, [esi + 0x54]
push dword [esi + 0xa0]
push edi
call dword [eax + 0x1c]
test al, al
jne 0x4a0c94
mov eax, 0x80004005
jmp 0x4a0cae
mov ecx, dword [esi + 0xac]
push dword [esi + 0xa4]
push dword [esi + 0xa0]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x4ac199
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x75d580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str.GlobalMemoryStatusEx
push 0x6af2f8
mov dword [ebp - 0x64], 0x40
and dword [esi + 4], 0
mov dword [esi], SysReAllocStringLen
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ac1fc
lea ecx, [ebp - 0x64]
push ecx
call eax
test eax, eax
je 0x4ac1fc
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.004ac11e
add esp, 0x10
mov dword [esi + 4], edx
jmp 0x4ac21b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], eax
cmovb eax, dword [ebp - 0xc]
and dword [esi + 4], 0
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.0048a267
leave
ret
Function at 0x4bf9b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
and dword [edi + 0xb0], 0
cmp dword [edi + 0xb4], 2
jne 0x4bf9f1
push 1
call fcn.004bf8fd
test eax, eax
je 0x4bf9ea
push dword [edi + 0x74]
mov ecx, edi
push dword [edi + 0x70]
call fcn.004bf1ca
jmp 0x4bfbba
and dword [edi + 0xb4], 0
mov eax, dword [edi + 0x3c]
push ebx
push esi
push 8
pop ecx
sub ecx, dword [edi + 0x38]
mov ebx, 0x6b27b0
shr eax, cl
shr eax, 0x10
cmp dword [edi + 0xa0], 0x25
movzx ecx, al
mov eax, 0x6b27e0
cmovae ebx, eax
mov dword [ebp - 8], ecx
mov eax, dword [edi + 0xac]
xor esi, esi
add eax, 0x10
add eax, ebx
movzx edx, byte [ebx]
xor edx, ecx
mov dword [ebp - 4], eax
push 8
movzx eax, byte [eax]
pop ecx
sub ecx, eax
shr edx, cl
test edx, edx
je 0x4bfa5a
mov edx, dword [ebp - 4]
sub edx, ebx
inc esi
inc ebx
push 8
pop ecx
movzx eax, byte [ebx + edx]
sub ecx, eax
movzx eax, byte [ebx]
xor eax, dword [ebp - 8]
shr eax, cl
test eax, eax
jne 0x4bfa43
mov eax, dword [ebp - 4]
movzx eax, byte [esi + eax]
add eax, dword [edi + 0x38]
mov dword [edi + 0x38], eax
cmp eax, 8
jb 0x4bfa9e
lea ebx, [edi + 0x40]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jb 0x4bfa81
mov ecx, ebx
call fcn.004ad9f1
mov dl, al
jmp 0x4bfa86
mov dl, byte [eax]
inc eax
mov dword [ebx], eax
mov ecx, dword [edi + 0x3c]
add dword [edi + 0x38], 0xfffffff8
shl ecx, 8
movzx eax, dl
or ecx, eax
cmp dword [edi + 0x38], 8
mov dword [edi + 0x3c], ecx
jae 0x4bfa6f
cmp esi, 9
jb 0x4bfb3c
jne 0x4bfaba
push dword [edi + 0x74]
inc dword [edi + 0xb4]
push dword [edi + 0x70]
jmp 0x4bfbb1
and dword [edi + 0xb4], 0
mov ecx, edi
cmp esi, 0xe
jne 0x4bfaed
push 0x6b2820
call fcn.004bf26f
push 0xf
mov ecx, edi
lea esi, [eax + 5]
call fcn.004bf8fd
add eax, 0x7fff
push esi
mov dword [edi + 0x70], eax
push eax
jmp 0x4bfbae
mov eax, dword [edi + 0x78]
sub eax, esi
mov dword [ebp - 8], esi
inc eax
and eax, 3
push 0x6b2810
mov ebx, dword [edi + eax*4 + 0x7c]
call fcn.004bf26f
mov esi, eax
cmp esi, 0xff
jne 0x4bfb25
cmp dword [ebp - 8], 0xa
jne 0x4bfb25
xor dword [edi + 0xac], 0x10
xor eax, eax
jmp 0x4bfbb8
cmp ebx, 0x100
jb 0x4bfb95
mov eax, dword [edi + 0xc0]
inc esi
dec eax
cmp ebx, eax
jb 0x4bfb95
inc esi
jmp 0x4bfb95
mov ecx, dword [edi + 0xa0]
and dword [edi + 0xb4], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0xa0], ecx
mov ecx, edi
push 0x6b2850
call fcn.004bf26f
movzx ecx, al
mov ebx, dword [edi + ecx*4 + 0x4c4]
test al, al
je 0x4bfb95
dec dword [edi + ebx*4 + 0x14c4]
mov eax, dword [edi + ecx*4 + 0x4c0]
inc dword [edi + eax*4 + 0x14c4]
mov dword [edi + ecx*4 + 0x4c4], eax
mov dword [edi + ecx*4 + 0x4c0], ebx
mov eax, dword [edi + 0x78]
mov dword [edi + eax*4 + 0x7c], ebx
mov eax, dword [edi + 0x78]
inc eax
mov dword [edi + 0x70], ebx
and eax, 3
add esi, 2
push esi
mov dword [edi + 0x78], eax
push ebx
mov dword [edi + 0x74], esi
mov ecx, edi
call fcn.004bf1ca
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4c6595
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov dword [ebp + 8], eax
cmp eax, 3
jae 0x4c65b4
push edi
call fcn.004c756a
jmp 0x4c660c
mov ecx, dword [edi]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
mov ecx, dword [edi + 0x24]
movzx eax, word [edi + eax*4 + 0x60]
xor edx, eax
mov eax, dword [edi + 4]
mov esi, dword [ecx + edx*4]
mov dword [ecx + edx*4], eax
push dword [edi + 0x30]
push dword [edi + 0x18]
push dword [edi + 0x14]
push dword [edi + 0x28]
push dword [edi]
push dword [edi + 4]
push esi
push dword [ebp + 8]
call fcn.004c76e4
add esp, 0x20
inc dword [edi + 0x14]
inc dword [edi]
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
jne 0x4c660d
push edi
call fcn.004c7192
pop ecx
sub ebx, 1
jne 0x4c65a1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c6cb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cmp eax, 3
jae 0x4c6cda
push esi
call fcn.004c756a
pop ecx
xor eax, eax
jmp 0x4c6dec
mov ecx, dword [esi]
push ebx
push edi
mov edi, dword [ebp + 0xc]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
mov ecx, dword [esi + 0x24]
push 2
movzx eax, word [esi + eax*4 + 0x60]
xor edx, eax
mov eax, dword [ecx + edx*4]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x14]
mov ebx, dword [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
add eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sub edx, eax
cmp edx, dword [ebp - 0xc]
jae 0x4c6dca
cmp dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x10]
sbb eax, eax
and eax, dword [ebp - 0xc]
sub eax, edx
add eax, dword [ebp - 0x20]
mov eax, dword [esi + eax*4]
mov dword [ebp - 8], eax
mov eax, edx
neg eax
mov dword [ebp - 0x28], eax
add eax, ebx
mov dword [ebp - 0x14], eax
mov esi, eax
mov al, byte [ebx + ecx]
cmp al, byte [esi + ecx]
mov esi, dword [ebp + 8]
jne 0x4c6db2
mov esi, dword [ebp - 0x14]
mov ecx, ebx
mov al, byte [ebx]
cmp al, byte [esi]
jmp 0x4c6d95
mov eax, dword [ebp - 0x24]
inc ecx
cmp ecx, eax
je 0x4c6dbd
mov esi, dword [ebp - 0x28]
mov al, byte [ecx]
cmp al, byte [ecx + esi]
mov esi, dword [ebp + 8]
je 0x4c6d85
sub ecx, ebx
cmp dword [ebp - 4], ecx
jae 0x4c6daf
lea eax, [edx - 1]
mov dword [edi], ecx
mov dword [edi + 4], eax
add edi, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
sub dword [ebp - 0x18], 1
je 0x4c6dca
mov eax, dword [ebp - 8]
jmp 0x4c6d41
sub eax, ebx
mov dword [edi], eax
lea eax, [edx - 1]
mov dword [edi + 4], eax
add edi, 8
sub edi, dword [ebp + 0xc]
inc dword [esi + 0x14]
mov eax, dword [esi + 4]
sar edi, 2
inc dword [esi]
inc eax
mov dword [esi + 4], eax
cmp eax, dword [esi + 8]
jne 0x4c6de8
push esi
call fcn.004c7192
pop ecx
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4c720c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
or dword [eax + 0x468], 0xffffffff
lea esi, [eax + 0x60]
or dword [eax + 0x46c], 0xffffffff
mov dword [eax + 0x34], ecx
mov word [eax + 0x1e], cx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
push 8
mov edx, ecx
pop edi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub edi, 1
jne 0x4c7248
mov dword [esi], edx
inc ecx
add esi, 4
cmp ecx, 0x100
jb 0x4c7243
pop edi
pop esi
pop ebp
ret
Function at 0x4c7997
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4c79cd
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4c79c0
cmp esi, ecx
jae 0x4c7ab0
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x4c7a46
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x6b2d90]
xor ecx, eax
or ecx, edx
jmp 0x4c7a96
cmp edi, 6
jbe 0x4c7a96
cmp edx, 4
jne 0x4c7a96
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4c79df
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4c85eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
or dword [edi], 0xffffffff
cmp dword [eax], 0x23170f69
jne 0x4c86c6
mov ecx, 0x40c1
cmp word [eax + 4], cx
jne 0x4c86c6
mov ebx, dword [ebp + 0x14]
mov edx, 0x2790
mov byte [ebx], 1
movzx ecx, word [eax + 6]
cmp cx, dx
jne 0x4c862f
mov byte [ebx], 0
jmp 0x4c863d
mov edx, 0x2791
cmp cx, dx
jne 0x4c86c6
mov ecx, dword [eax + 8]
xor esi, esi
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], ecx
mov dword [ebp - 4], eax
cmp dword [0x76a888], esi
jbe 0x4c86c6
mov ch, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [esi*4 + 0x76a890]
cmp eax, dword [edx + 8]
jne 0x4c869c
mov edi, dword [ebp - 4]
cmp edi, dword [edx + 0xc]
mov edi, dword [ebp + 0x18]
jne 0x4c869c
xor eax, eax
cmp byte [ebx], al
je 0x4c867b
cmp dword [edx + 4], eax
jmp 0x4c867d
cmp dword [edx], eax
sete al
test eax, eax
jne 0x4c8699
mov cl, byte [edx + 0x18]
test ch, ch
je 0x4c8692
test cl, cl
sete al
jmp 0x4c8695
movzx eax, cl
test eax, eax
je 0x4c86a7
mov eax, dword [ebp + 8]
inc esi
cmp esi, dword [0x76a888]
jb 0x4c8659
jmp 0x4c86c6
movzx eax, byte [ebp + 0xc]
movzx ecx, byte [ebp + 0xc]
xor eax, 1
cmp dword [edx + 0x14], 1
cmove eax, ecx
test eax, eax
je 0x4c86c4
mov eax, 0x80004002
jmp 0x4c86c8
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c888c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4cb346
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 8
jb 0x4cb36f
mov edi, esi
shr edi, 3
mov eax, dword [ecx + 4]
sub esi, 8
xor eax, dword [ecx]
add ecx, 8
xor edx, eax
sub edi, 1
jne 0x4cb35d
cmp esi, 4
jb 0x4cb379
xor edx, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x4cb38c
movzx eax, byte [ecx]
shl eax, 0x10
xor edx, eax
inc ecx
jmp 0x4cb395
mov eax, edx
mov edi, ecx
cmp esi, 1
jbe 0x4cb3a0
movzx eax, byte [ecx]
shl eax, 8
xor edx, eax
inc ecx
jmp 0x4cb3a8
mov edx, eax
mov ecx, edi
test esi, esi
je 0x4cb3ad
movzx ecx, byte [ecx]
xor edx, ecx
pop edi
mov eax, edx
pop esi
pop ebp
ret