joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4756e5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test esi, esi
jne 0x4757ff
cmp dword [ebx], 0x74
je 0x4757ff
mov ecx, dword [0x5dbbc4]
test ecx, ecx
je 0x47571b
call fcn.004455b8
mov esi, eax
jmp 0x47571d
xor esi, esi
push 0x2800
call fcn.00534202
mov edi, eax
mov dword [esp], 0x5000
call fcn.00534202
mov dword [esp], str.set_default_char_format_failed__only_CHARFORMAT2W_can_be_set_for_default_char_format
mov ebx, eax
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.0044fe02
add esp, 0x10
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x475777
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
call fcn.005231b0
pop ecx
test esi, esi
je 0x4757b6
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
call dword [eax + 0x2c]
test al, al
je 0x4757b6
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SRichEdit::OnSetCharFormat
push 0x550
push str.E:_suohaonekeyfun_souiSOUI_srccontrolSRichEdit.cpp
push edi
push str.soui
push 1
push 0
call dword [eax + 0x34]
jmp 0x4757f4
mov ebx, 0x2800
push ebx
call fcn.00534202
mov dword [esp], 0x550
mov esi, eax
push str.E:_suohaonekeyfun_souiSOUI_srccontrolSRichEdit.cpp
push str.SOUI::SRichEdit::OnSetCharFormat
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.0044fde3
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push esi
call fcn.005231b0
pop ecx
push edi
call fcn.005231b0
pop ecx
xor eax, eax
jmp 0x475840
mov eax, dword [edi + 0x380]
push 0
push ebx
push esi
mov ecx, dword [eax + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test esi, esi
jne 0x47583d
mov eax, dword [ebp - 4]
add edi, 0x218
push 0x1d
pop ecx
mov esi, ebx
mov edx, 0x20000
mov eax, dword [eax + 0x380]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xc]
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 0x4c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4772fc
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28
mov eax, 0x56ef4f
call fcn.00510e9f
mov ebx, ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 0x10], eax
call esi
and eax, 0x8000
lea esi, [ebx + 0x170]
and edi, 0x8000
jne 0x477365
cmp dword [ebp - 0x10], 0
jne 0x47734f
test eax, eax
jne 0x477348
inc eax
xor ecx, ecx
jmp 0x477391
push 2
pop eax
push 4
jmp 0x477390
test eax, eax
jne 0x47735a
push 4
pop eax
push 2
jmp 0x477390
push 6
pop eax
push 0x10
mov word [esi], ax
pop eax
jmp 0x477394
cmp dword [ebp - 0x10], 0
jne 0x47737e
test eax, eax
jne 0x477377
push 8
xor ecx, ecx
pop eax
inc ecx
jmp 0x477391
push 0x20
pop eax
push 5
jmp 0x477390
test eax, eax
jne 0x477389
push 0x40
pop eax
push 3
jmp 0x477390
mov eax, 0x80
push 7
pop ecx
mov word [esi], cx
test word [ebx + 0x174], ax
je 0x4773a7
mov ax, word [ebx + 0x176]
mov word [esi], ax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044a5c1
mov dword [ebp - 0x34], 0x589c64
mov dword [ebp - 0x2c], 0x589c78
mov ax, word [esi]
lea ecx, [ebp - 0x34]
and dword [ebp - 4], 0
mov word [ebp - 0x12], ax
mov ax, word [ebx + 0x172]
mov word [ebp - 0x14], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x94]
call fcn.00510e6d
ret

Function at 0x48c6a6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
jne 0x48c6de
push dword [ecx + 4]
call fcn.0045b1a7
pop ecx
test eax, eax
je 0x48c6ca
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x48c6de
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x48c6de
xor eax, eax
inc eax
jmp 0x48c6e0
xor eax, eax
pop ebp
ret 4
Function at 0x48c7c9
Capabilities:
Log keystrokes via polling

Disassembly:
push 4
mov eax, 0x571b95
call fcn.00510e9f
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.0048c6a6
test eax, eax
je 0x48c804
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.0048c25f
xor eax, eax
inc eax
jmp 0x48c8f8
push dword [ebx + 4]
call fcn.0045b1a7
mov esi, eax
mov dword [ebp - 0x10], esi
pop ecx
test esi, esi
je 0x48c8a2
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x48c8a2
cmp edi, 0x25
je 0x48c83d
cmp edi, 0x27
je 0x48c839
cmp edi, 0x26
je 0x48c83d
cmp edi, 0x28
jne 0x48c8a2
push 3
jmp 0x48c83f
push 2
pop edi
jmp 0x48c84d
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x48c88c
push edi
mov ecx, esi
call fcn.0044c5ab
mov esi, eax
test esi, esi
jne 0x48c842
mov ecx, dword [ebp - 0x10]
cmp edi, 3
setne al
push eax
call fcn.0044c2af
mov ecx, eax
jmp 0x48c87c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x48c88c
push edi
mov ecx, esi
call fcn.0044c5ab
mov esi, eax
test esi, esi
jne 0x48c86e
jmp 0x48c7fc
push 1
mov ecx, esi
call fcn.0044c4e1
push eax
mov ecx, ebx
call fcn.0048cb74
jmp 0x48c7fc
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.0048e2eb
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.0048c94c
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call sym.steamworks.exe_public_virtual:_void___thiscall_Json::CharReader::destructor_void_
mov eax, ebx
call fcn.00510e6d
ret 4
Function at 0x48e43d
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x571d75
call fcn.00510e9f
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x5d300c]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
and dword [ebp - 4], 0
inc ebx
movzx edx, cx
mov dword [ebp - 0x10], ebx
push 2
pop edi
cmp edx, 0x25
ja 0x48e4e6
je 0x48e4dc
mov eax, edx
sub eax, 0xd
je 0x48e4d2
sub eax, 0xe
je 0x48e4c8
sub eax, 5
je 0x48e4be
sub eax, ebx
je 0x48e4b4
sub eax, ebx
je 0x48e4aa
sub eax, ebx
je 0x48e4a0
sub eax, ebx
jne 0x48e51d
push str.Home
jmp 0x48e63e
push 0x58cc6c
jmp 0x48e63e
push str.PageDown
jmp 0x48e63e
push str.PageUp
jmp 0x48e63e
push str.Space
jmp 0x48e63e
push 0x58cc20
jmp 0x48e63e
push 0x58cc28
jmp 0x48e63e
push str.Left
jmp 0x48e63e
mov eax, edx
sub eax, 0x26
je 0x48e639
sub eax, 1
je 0x48e632
sub eax, 1
je 0x48e62b
sub eax, edi
je 0x48e624
sub eax, 3
je 0x48e61d
sub eax, 1
je 0x48e616
cmp cx, 0x30
jb 0x48e529
cmp cx, 0x39
jbe 0x48e532
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x48e549
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.00419f20
jmp 0x48e645
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x48e56d
lea eax, [edx - 0x60]
push eax
push str.Num__d
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004411c3
add esp, 0x10
mov dword [ebp - 4], ebx
jmp 0x48e5bf
cmp cx, 0x6a
jne 0x48e57d
push 0x58cce0
jmp 0x48e63e
cmp cx, 0x6b
jne 0x48e58d
push str.Num_
jmp 0x48e63e
cmp cx, 0x6e
jne 0x48e59d
push str.Num_Del
jmp 0x48e63e
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x48e5d4
lea eax, [edx - 0x6f]
push eax
push 0x58cd08
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004411c3
add esp, 0x10
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x5d3008]
je 0x48e645
call fcn.004401b9
jmp 0x48e645
push edi
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp al, 0x3d
jg 0x48e5f4
je 0x48e600
cmp al, 0x27
je 0x48e600
cmp al, 0x2b
jle 0x48e645
cmp al, 0x2f
jle 0x48e600
cmp al, 0x3b
je 0x48e600
jmp 0x48e645
cmp al, 0x5b
jl 0x48e645
cmp al, 0x5d
jle 0x48e600
cmp al, 0x60
jne 0x48e645
cbw
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.00455e6e
jmp 0x48e645
push str.Delete
jmp 0x48e63e
push str.Insert
jmp 0x48e63e
push str.Print
jmp 0x48e63e
push str.Down
jmp 0x48e63e
push str.Right
jmp 0x48e63e
push 0x58cc34
mov ecx, esi
call fcn.00419b20
mov eax, esi
call fcn.00510e6d
ret

Function at 0x4946b5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x49471d
mov ecx, esi
call fcn.00494722
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x3ac]
test ecx, ecx
je 0x4946f8
push 0
call fcn.0044eb91
and dword [esi + 0x3ac], 0
mov ecx, dword [0x5dbd04]
lea ecx, [ecx + 8]
call fcn.00441058
mov ecx, dword [esi + 0x3a4]
test ecx, ecx
je 0x49471d
pop esi
mov ecx, dword [ecx + 0x174]
pop ebp
jmp fcn.00495254
pop esi
pop ebp
ret 4
Function at 0x49b229
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x5dbd1b], 0
jne 0x49b2d8
push esi
push 0x58e10c
call fcn.004a8901
mov dword [esp], 0x58e0e8
call fcn.004a8901
mov dword [esp], 0x58e22c
call fcn.004a8901
mov dword [esp], 0x58e2a8
call fcn.004a8901
mov dword [esp], 0x58e208
call fcn.004a8901
mov esi, 0x58e378
push esi
call fcn.004b2b93
push esi
call fcn.004b2b93
push 0x58e398
call fcn.004b2b93
push 0x58e3b8
call fcn.004b2b93
push 0x58e1b0
call fcn.004b2b93
push 0x58e338
call fcn.004b2b93
push 0x58e358
call fcn.004b2b93
push 0x58e250
call fcn.004b2b93
push 0x58e270
call fcn.004b2b93
add esp, 0x28
mov byte [0x5dbd1b], 1
pop esi
jmp 0x4baea5
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4baead
mov dword [edx*4 + 0x5ef860], ecx
inc edx
cmp edx, 0x100
jb 0x4baea8
mov esi, 0x800
jmp 0x4baef5
mov ecx, dword [edx*4 + 0x5ef460]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x5ef860]
mov dword [edx*4 + 0x5ef860], ecx
inc edx
cmp edx, esi
jb 0x4baed9
mov eax, 0x56a3a0
mov esi, 0x56a2c0
mov dword [0x5ef844], eax
mov dword [0x5ef83c], eax
mov dword [0x5ef840], esi
call fcn.004d36cd
mov ecx, dword [0x5ef83c]
test eax, eax
cmove ecx, esi
mov dword [0x5ef83c], ecx
pop esi
ret

Function at 0x49c2d3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49c2e1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x49c2f0
Capabilities:
Copy file
Delete file

Disassembly:
push 0x44
mov eax, 0x572da4
call fcn.00510ed2
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x49c3e1
cmp dword [esi + 0x10], 0x104
ja 0x49c3e1
push esi
call fcn.0049c2d3
pop ecx
test al, al
jne 0x49c328
inc al
jmp 0x49c3e3
xor edi, edi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.0049693f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edi
add eax, 2
mov dword [ebp - 4], edi
push eax
call fcn.0049c6ed
push 0x1e
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.0051f6b0
mov eax, dword [ebp - 0x40]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x3a], edi
or eax, 0x414
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x36], edi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp ecx, 8
jb 0x49c3dd
mov eax, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
cmp ecx, 0x1000
jb 0x49c3d4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00405a90
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push ecx
push eax
call fcn.0051012c
pop ecx
pop ecx
mov al, bl
jmp 0x49c3e3
xor al, al
call fcn.00510e81
ret
Function at 0x49e413
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa8], 5
jne 0x49e43a
cmp dword [ebp + 0xc], 0
je 0x49e43a
mov ecx, esi
call fcn.0049e2a6
mov eax, 0x80004005
jmp 0x49e55c
xor ecx, ecx
push edi
cmp dword [esi + 0x64], ecx
jne 0x49e469
push 0x58ec44
call fcn.0049e704
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x49e559
mov edx, dword [ecx]
lea eax, [esi + 0x24]
push eax
call dword [edx + 0x14]
jmp 0x49e559
cmp byte [esi + 0x74], cl
jne 0x49e47e
cmp byte [esi + 0x80], cl
jne 0x49e47e
cmp byte [esi + 0x8c], cl
je 0x49e4e5
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x49e489
mov eax, dword [eax]
push ecx
push 0x80
push 3
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x49e4e5
xor edx, edx
lea ecx, [esi + 0x78]
cmp byte [esi + 0x74], dl
cmovne edx, ecx
xor eax, eax
cmp byte [esi + 0x80], al
lea ecx, [esi + 0x84]
push edx
cmovne eax, ecx
xor ecx, ecx
cmp byte [esi + 0x8c], cl
push eax
lea eax, [esi + 0x90]
cmovne ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [esi + 0x6d], 0
je 0x49e500
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x49e4f6
mov eax, dword [eax]
push dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea edi, [esi + 0x54]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x49e50d
mov eax, dword [edi]
push eax
push str.FileDone:_s_n
call fcn.0049e704
pop ecx
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x49e559
push dword [esi + 0xa4]
mov eax, dword [ecx]
push dword [esi + 0xa0]
push edi
call dword [eax + 0x1c]
test al, al
jne 0x49e541
mov eax, 0x80004005
jmp 0x49e55b
mov ecx, dword [esi + 0xac]
push dword [esi + 0xa4]
push dword [esi + 0xa0]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x4ae7b7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56db60
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5d3640]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x30]
mov dword [esi], vtable.NCompress::NLzma::CDecoder.0
push 0x5d34e8
push eax
mov dword [esi + 4], vtable.NCompress::NLzma::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NLzma::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NLzma::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NLzma::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NLzma::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NLzma::CDecoder.6.0
call fcn.004ccbdd
push dword [esi + 0x24]
call fcn.0043fea6
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4ae836
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x4b5765
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
and dword [edi + 0x2cb0], 0
cmp dword [edi + 0x2cb8], 2
jne 0x4b57ab
push 1
lea ecx, [edi + 0x38]
call fcn.004b56df
test eax, eax
je 0x4b57a4
push dword [edi + 0x80]
mov ecx, edi
push dword [edi + 0x7c]
call fcn.004b4f53
jmp 0x4b596b
and dword [edi + 0x2cb8], 0
mov edx, dword [edi + 0x38]
mov eax, dword [edi + 0x3c]
push ebx
push 8
pop ecx
sub ecx, edx
mov dword [ebp - 0x10], edx
shr eax, cl
shr eax, 0x10
cmp dword [edi + 0x2ca0], 0x25
movzx eax, al
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x2cac]
jae 0x4b57e7
test eax, eax
mov ebx, 0x58ffb4
mov ecx, 0x58ffa4
mov eax, 0x58ffe4
jmp 0x4b57f8
test eax, eax
mov ebx, 0x58ffd4
mov ecx, 0x58ffc4
mov eax, 0x590020
cmove ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov ecx, ebx
xor eax, dword [ebp - 8]
mov edx, 0xff
push esi
xor esi, esi
mov cl, byte [ecx]
sar edx, cl
not edx
test eax, edx
je 0x4b5834
mov edi, dword [ebp - 4]
inc esi
mov edx, 0xff
mov cl, byte [esi + ebx]
mov eax, dword [edi + esi*4]
xor eax, dword [ebp - 8]
sar edx, cl
not edx
test eax, edx
jne 0x4b581a
mov edi, dword [ebp - 0xc]
movzx eax, byte [esi + ebx]
lea ebx, [edi + 0x38]
add eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebx], eax
call fcn.004b5654
cmp esi, 9
jb 0x4b58ea
jne 0x4b5866
push dword [edi + 0x80]
inc dword [edi + 0x2cb8]
push dword [edi + 0x7c]
jmp 0x4b5962
and dword [edi + 0x2cb8], 0
mov ecx, edi
cmp esi, 0xe
jne 0x4b5899
push 0x58fe60
call fcn.004b4feb
push 0xf
mov ecx, ebx
lea esi, [eax + 5]
call fcn.004b56df
add eax, 0x7fff
push esi
mov dword [edi + 0x7c], eax
push eax
jmp 0x4b595c
mov eax, dword [edi + 0x78]
sub eax, esi
inc eax
and eax, 3
push 0x58fe28
mov ebx, dword [edi + eax*4 + 0x68]
call fcn.004b4feb
add eax, 2
cmp eax, 0x101
jne 0x4b58cd
cmp esi, 0xa
jne 0x4b58cd
xor dword [edi + 0x2cac], 1
xor eax, eax
jmp 0x4b5969
cmp ebx, 0x100
lea ecx, [eax + 1]
cmovb ecx, eax
mov eax, dword [edi + 0x2cc8]
dec eax
cmp ebx, eax
lea esi, [ecx + 1]
cmovb esi, ecx
jmp 0x4b5946
mov ecx, dword [edi + 0x2ca0]
and dword [edi + 0x2cb8], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0x2ca0], ecx
mov ecx, edi
push 0x58ff08
call fcn.004b4feb
movzx ecx, al
mov ebx, dword [edi + ecx*4 + 0x494]
test al, al
je 0x4b5943
dec dword [edi + ebx*4 + 0x1494]
mov eax, dword [edi + ecx*4 + 0x490]
inc dword [edi + eax*4 + 0x1494]
mov dword [edi + ecx*4 + 0x494], eax
mov dword [edi + ecx*4 + 0x490], ebx
add esi, 2
mov eax, dword [edi + 0x78]
push esi
push ebx
mov dword [edi + eax*4 + 0x68], ebx
mov eax, dword [edi + 0x78]
inc eax
mov dword [edi + 0x7c], ebx
and eax, 3
mov dword [edi + 0x78], eax
mov dword [edi + 0x80], esi
mov ecx, edi
call fcn.004b4f53
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4bcdef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 8
jb 0x4bce18
mov edi, esi
shr edi, 3
mov eax, dword [ecx + 4]
sub esi, 8
xor eax, dword [ecx]
add ecx, 8
xor edx, eax
sub edi, 1
jne 0x4bce06
cmp esi, 4
jb 0x4bce22
xor edx, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x4bce35
movzx eax, byte [ecx]
shl eax, 0x10
xor edx, eax
inc ecx
jmp 0x4bce3e
mov eax, edx
mov edi, ecx
cmp esi, 1
jbe 0x4bce49
movzx eax, byte [ecx]
shl eax, 8
xor edx, eax
inc ecx
jmp 0x4bce51
mov edx, eax
mov ecx, edi
test esi, esi
je 0x4bce56
movzx ecx, byte [ecx]
xor edx, ecx
pop edi
mov eax, edx
pop esi
pop ebp
ret

Function at 0x4bdf05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
or dword [edi], 0xffffffff
cmp dword [eax], 0x23170f69
jne 0x4bdfe0
mov ecx, 0x40c1
cmp word [eax + 4], cx
jne 0x4bdfe0
mov ebx, dword [ebp + 0x14]
mov edx, 0x2790
mov byte [ebx], 1
movzx ecx, word [eax + 6]
cmp cx, dx
jne 0x4bdf49
mov byte [ebx], 0
jmp 0x4bdf57
mov edx, 0x2791
cmp cx, dx
jne 0x4bdfe0
mov ecx, dword [eax + 8]
xor esi, esi
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], ecx
mov dword [ebp - 4], eax
cmp dword [0x5dc170], esi
jbe 0x4bdfe0
mov ch, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [esi*4 + 0x5dc178]
cmp eax, dword [edx + 8]
jne 0x4bdfb6
mov edi, dword [ebp - 4]
cmp edi, dword [edx + 0xc]
mov edi, dword [ebp + 0x18]
jne 0x4bdfb6
xor eax, eax
cmp byte [ebx], al
je 0x4bdf95
cmp dword [edx + 4], eax
jmp 0x4bdf97
cmp dword [edx], eax
sete al
test eax, eax
jne 0x4bdfb3
mov cl, byte [edx + 0x18]
test ch, ch
je 0x4bdfac
test cl, cl
sete al
jmp 0x4bdfaf
movzx eax, cl
test eax, eax
je 0x4bdfc1
mov eax, dword [ebp + 8]
inc esi
cmp esi, dword [0x5dc170]
jb 0x4bdf73
jmp 0x4bdfe0
movzx eax, byte [ebp + 0xc]
movzx ecx, byte [ebp + 0xc]
xor eax, 1
cmp dword [edx + 0x14], 1
cmove eax, ecx
test eax, eax
je 0x4bdfde
mov eax, 0x80004002
jmp 0x4bdfe2
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4be7a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov dword [ebp + 8], eax
cmp eax, 3
jae 0x4be7c4
push edi
call fcn.004bf513
jmp 0x4be81c
mov ecx, dword [edi]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
mov ecx, dword [edi + 0x24]
xor edx, dword [edi + eax*4 + 0x60]
mov eax, dword [edi + 4]
movzx edx, dx
mov esi, dword [ecx + edx*4]
mov dword [ecx + edx*4], eax
push dword [edi + 0x30]
push dword [edi + 0x18]
push dword [edi + 0x14]
push dword [edi + 0x28]
push dword [edi]
push dword [edi + 4]
push esi
push dword [ebp + 8]
call fcn.004bf692
add esp, 0x20
inc dword [edi + 0x14]
inc dword [edi]
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
jne 0x4be81d
push edi
call fcn.004bf1a1
pop ecx
sub ebx, 1
jne 0x4be7b1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bf21b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov dword [eax + 0x34], ecx
lea esi, [eax + 0x60]
mov word [eax + 0x1e], cx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
push 8
mov edx, ecx
pop edi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub edi, 1
jne 0x4bf249
mov dword [esi], edx
inc ecx
add esi, 4
cmp ecx, 0x100
jb 0x4bf244
pop edi
pop esi
pop ebp
ret

Function at 0x4bf972
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4bf9a8
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4bf99b
cmp esi, ecx
jae 0x4bfa8b
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x4bfa21
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x590540]
xor ecx, eax
or ecx, edx
jmp 0x4bfa71
cmp edi, 6
jbe 0x4bfa71
cmp edx, 4
jne 0x4bfa71
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4bf9ba
pop edi
pop esi
pop ebx
leave
ret 4