joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4b6298
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x4b62c8
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.004053ec
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.004b6040
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4b62ab
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b60d8
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.004b6040
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x4b62cd
mov esp, ebp
pop ebp
ret
Function at 0x4c19d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c1a95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x113]
mov edx, 0x4c1aa8
call fcn.0040c130
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
xor edx, edx
call fcn.00405a6c
je 0x4c1a3c
lea eax, [ebp - 0x21c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.004051e4
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x108]
call fcn.0040c130
jmp 0x4c1a4d
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.004058f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1a9c
lea eax, [ebp - 0x21c]
call fcn.00404f5c
ret

Function at 0x4c7aa8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403830
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4cbc30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cbcc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x604594]
cmp dword [eax], 2
jne 0x4cbc70
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x4cbca3
lea eax, [ebp - 8]
mov edx, esi
call fcn.004058ac
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004051e4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbcc8
lea eax, [ebp - 8]
call fcn.00405740
lea eax, [ebp - 4]
call fcn.00404f5c
ret
Function at 0x4cbcd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4cbd68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x604594]
cmp dword [eax], 2
jne 0x4cbd17
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
jmp 0x4cbd4a
lea eax, [ebp - 8]
mov edx, esi
call fcn.004058ac
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004051e4
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbd6f
lea eax, [ebp - 8]
call fcn.00405740
lea eax, [ebp - 4]
call fcn.00404f5c
ret

Function at 0x4cc404
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push esp
push 2
push 0
mov eax, edi
call fcn.004053ec
mov edx, eax
mov eax, esi
call fcn.004cb834
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4cc462
mov eax, ebp
call fcn.004053ec
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
jne 0x4cc46b
mov ecx, ebp
mov edx, edi
mov eax, esi
call fcn.004cb5d8
jmp 0x4cc46b
mov edx, edi
mov eax, esi
call fcn.004cb55c
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cc474
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cc5c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004053ec
mov edx, eax
mov eax, esi
call fcn.004cb834
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x4cc59c
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x14], 0
je 0x4cc570
mov edi, dword [ebp - 0x14]
dec edi
cmp edi, 0
jb 0x4cc570
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00405680
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 4]
call fcn.004053ec
call fcn.0040c070
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405680
push dword [ebp - 8]
push 0x4cc5dc
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004052f0
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.004cc474
mov ebx, eax
test bl, bl
je 0x4cc570
dec edi
cmp edi, 0xffffffff
jne 0x4cc4fa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
je 0x4cc5a6
mov eax, dword [ebp - 8]
call fcn.004053ec
mov edx, eax
mov eax, esi
call fcn.004cb834
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
jmp 0x4cc5a6
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004cb55c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc5cb
lea eax, [ebp - 0x1c]
call fcn.00404f5c
lea eax, [ebp - 4]
call fcn.00404f5c
ret

Function at 0x4cc5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.004053ec
mov edx, eax
mov eax, ebx
call fcn.004cb834
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x4cc64b
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4cdd5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cdf39
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403830
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x5fe30c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5fe310], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5fe314], eax
mov eax, dword [0x604594]
cmp dword [eax], 2
sete byte [0x5fdc04]
push 0x4cdf44
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004d0794
cmp byte [0x5fdc04], 0
jne 0x4cdde8
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004d08d8
test al, al
je 0x4cdde8
mov eax, dword [ebp - 0x4c]
mov dword [0x60ae2c], eax
jmp 0x4cddef
xor eax, eax
mov dword [0x60ae2c], eax
call fcn.004cda9c
and eax, 0x7f
cmp eax, 0x12
ja case.0x4cde00.0
jmp dword [eax*4 + 0x4cde07]
mov byte [0x5fdbf0], 1
jmp case.0x4cde00.0
mov byte [0x5fdbf4], 1
jmp case.0x4cde00.0
mov byte [0x5fdbf8], 1
jmp case.0x4cde00.0
mov byte [0x5fdbfc], 1
jmp case.0x4cde00.0
mov byte [0x5fdc00], 1
jmp case.0x4cde00.0
mov byte [0x5fdc08], 1
mov byte [0x5fdc0c], 1
jmp case.0x4cde00.0
mov byte [0x5fdc08], 1
mov byte [0x5fdc10], 1
jmp case.0x4cde00.0
mov byte [0x5fdc08], 1
mov byte [0x5fdc10], 1
mov byte [0x5fdc14], 1
jmp case.0x4cde00.0
mov byte [0x5fdc18], 1
jmp case.0x4cde00.0
mov byte [0x5fdc1c], 1
jmp case.0x4cde00.0
mov byte [0x5fdc20], 1
jmp case.0x4cde00.0
mov byte [0x5fdc24], 1
jmp case.0x4cde00.0
mov byte [0x5fdc28], 1
jmp case.0x4cde00.0
mov byte [0x5fdc2c], 1
jmp case.0x4cde00.0
mov byte [0x5fdc30], 1
jmp case.0x4cde00.0
mov byte [0x5fdc34], 1
jmp case.0x4cde00.0
mov byte [0x5fdc38], 1
jmp case.0x4cde00.0
mov byte [0x5fdc3c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdf40
lea eax, [ebp - 4]
call fcn.00404f5c
ret

Function at 0x4cf804
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4cf819
add esp, 0xfffffff0
call fcn.00404364
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00403fb4
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00404fb0
mov eax, esi
call fcn.004053ec
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA_1
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4cf86d
mov ecx, dword [0x604398]
mov dl, 1
mov eax, dword [0x4cf63c]
call fcn.004d03bc
call fcn.004048b4
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4cf894
call fcn.004043bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4d0770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x4d078e
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4d0786
test al, 0x10
je 0x4d078a
xor eax, eax
jmp 0x4d0790
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x4d08d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d097f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4d0969
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405680
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4d0969
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4d0990
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4d0969
cmp dword [ebp - 0xc], 0x34
jne 0x4d0969
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0986
lea eax, [ebp - 4]
call fcn.00404f5c
ret

Function at 0x4d0994
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4d09a9
add esp, 0xfffffff0
call fcn.00404364
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4d09de
mov ecx, dword [0x603e50]
mov dl, 1
mov eax, dword [0x4d0544]
call fcn.00411330
call fcn.004048b4
lea eax, [ebx + 4]
mov edx, esi
call fcn.00405680
mov eax, dword [ebx + 4]
call fcn.004053ec
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.00412e20
mov eax, ebx
call fcn.004d0ffc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d0a26
call fcn.004043bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d3c8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004053dc
mov eax, dword [ebp - 8]
call fcn.004053dc
xor eax, eax
push ebp
push 0x4d3d9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f5c
cmp dword [ebp - 4], 0
je 0x4d3ce4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4d3ce4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405498
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d3d7f
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004053ec
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d3d6f
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405680
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004053ec
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4d3d5d
sub esi, 4
mov esi, dword [esi]
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00405458
jmp 0x4d3d76
mov eax, ebx
call fcn.00404f5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3da1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f80
ret
Function at 0x4d4160
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x5fedc0
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4d417f
mov esi, 1
mov edx, 0x5feec8
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4d41f8
dec ebx
je 0x4d421a
dec ebx
je 0x4d423c
dec ebx
je 0x4d425d
jmp 0x4d4277
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d4277
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d4277
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d4277
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4d41e8
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4d419b
mov esi, 0x20
mov eax, 0x5fedf0
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4d429c
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d42d8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x5fee77]
test bl, bl
jbe 0x4d4309
lea eax, [esi + 0x3e0]
call fcn.004d42b4
lea eax, [esi + 0x3fc]
call fcn.004d42b4
dec bl
jne 0x4d42ef
mov cl, 0x30
mov edi, 0x5fee48
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4d432a
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4d4337
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4d4313
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d4344
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004d40f8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d4360
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004d40f8
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004d40f8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4d437c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004d42d8
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4d43a6
mov bl, 1
mov eax, 0x5fed40
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4d43df
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4d43ec
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4d43cb
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4d4416
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004d4160
jmp 0x4d443d
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004d4160
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4d4445
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4d43fe
mov bl, 0x40
mov esi, 0x5fed80
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x4d44ab
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4d44b8
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4d4494
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004d4120
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d44c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d51f8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
mov esi, 1
xor ebx, ebx
mov eax, ebp
test eax, eax
je 0x4d5213
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, edi
call fcn.00405680
cmp esi, dword [esp]
jg 0x4d536a
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi - 1]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jg 0x4d5323
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi - 1]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jg 0x4d52f2
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 1]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi + 1]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
jmp 0x4d535e
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040544c
mov byte [eax + ebx - 1], 0x3d
jmp 0x4d535e
inc ebx
mov eax, edi
call fcn.0040544c
movzx edx, byte [ebp + esi - 1]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + 0x5ff098]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040544c
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.0040544c
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jle 0x4d523a
mov eax, edi
mov edx, ebx
call fcn.00405680
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d55b4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4d5665
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4d5660
mov eax, ebp
mov edx, 8
call fcn.00405680
push 1
mov eax, ebp
call fcn.0040544c
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004d4344
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret