joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45661a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x4565ca
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4564da
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.00452cd0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x45655c
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.00452cd0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x4565b1
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00452cd0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.00431490
lea eax, [0x47e061]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00431cf0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.004319e0
call fcn.00431690
call fcn.004314f0
lea eax, [0x4831a4]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0045d710
nop
call fcn.00461860
jmp fcn.00456410
Function at 0x45aee0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
test eax, eax
je 0x45afe0
mov eax, dword [0x50d234]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x9c]
lea ebx, [eax + 0x1d0]
mov dword [esp + 0x30], ebx
lea ebp, [eax + 0x318]
mov dword [esp + 0x2c], ebp
add ecx, 1
mov dword [eax + 0x98], ecx
adc edx, 0
mov dword [eax + 0x9c], edx
mov ecx, dword [eax + 0xa8]
mov dword [ecx], 0
call fcn.0045da00
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0042e5e0
mov eax, dword [esp + 0x28]
mov byte [eax + 0x8c], 1
inc dword [eax + 0xa0]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.004628f0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov byte [ecx + 0x8c], 0
dec dword [ecx + 0xa0]
nop
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.00467250
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x30]
call fcn.00463304
call fcn.0045db80
mov eax, dword [0x50d234]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x1d0]
lea esi, [esp + 0xc]
call fcn.00463304
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
lea eax, [0x47d5dd]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0045d710
nop
int3
Function at 0x45f5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45f74a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45f740
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45f62a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45f62a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45f63d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x45f717
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x45f70b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x45f702
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x45f690
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x45f6d3
mov eax, 1
cmp eax, ecx
ja 0x45f6c7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00462d40
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x45f6fd
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45f6cc
mov ecx, dword [esp + 0xc]
jmp 0x45f695
call fcn.00462ce0
xor eax, eax
mov ecx, eax
call fcn.00462cd0
call fcn.00462d40
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x45f73b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45f710
mov ecx, dword [esp + 0x18]
jmp 0x45f642
call fcn.00462ce0
xor eax, eax
mov ecx, eax
call fcn.00462cd0
nop
call fcn.00461860
jmp fcn.0045f5d0
Function at 0x460b10
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x460bab
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x50d234]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00462e27
lea ecx, [0x450770]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00461770
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00461860
jmp fcn.00460b10
Function at 0x462b10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x50d3e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46129b
je 0x4612ee
cmp ebx, 0x20
jbe 0x4612f4
cmp ebx, 0x40
jbe 0x46133a
jmp 0x4613db
test ebx, ebx
je 0x4612e4
add eax, 0x10
test ax, 0xff0
je 0x4612d0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x498420]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x498520]
jmp 0x4612b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4612b8
pxor xmm1, xmmword [0x50d3f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x50d3f0]
pxor xmm2, xmmword [0x50d400]
pxor xmm3, xmmword [0x50d410]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x50d3f0]
pxor xmm2, xmmword [0x50d400]
pxor xmm3, xmmword [0x50d410]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46143a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x50d125], 0
je 0x462b2a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x461260
jmp fcn.00407be0

Function at 0x463980
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46399a
mov ecx, 0x14
jmp 0x4639a3
shl ecx, 2
add ecx, 0xe10
mov dword [0x50d234], ecx
ret
Function at 0x401bf8
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [ebp + 8]
cmp al, 7
jb 0x401c4d
sub al, 7
je 0x401cc1
dec al
je 0x401c1b
sub al, 2
je 0x401c45
sub al, 3
je 0x401c37
jmp 0x401c4d
mov eax, dword [0x406240]
cmp eax, dword [0x4061c0]
jle 0x401cc1
dec dword [0x406240]
jmp 0x401cc1
mov edi, dword [0x4061c0]
mov dword [0x406240], edi
jmp 0x401cc1
inc dword [0x406230]
jmp 0x401cc1
mov word [ebp - 8], 1
mov word [ebp - 6], 1
mov word [ebp - 0xc], 0
mov word [ebp - 0xa], 0
movzx ax, byte [ebp + 8]
mov word [ebp - 4], ax
movzx ax, byte [0x406180]
mov word [ebp - 2], ax
mov eax, dword [0x406240]
dec eax
mov word [ebp - 0x14], ax
mov eax, dword [0x406230]
dec eax
mov word [ebp - 0x12], ax
mov eax, dword [0x406240]
dec eax
mov word [ebp - 0x10], ax
mov eax, dword [0x406230]
dec eax
mov word [ebp - 0xe], ax
lea edi, [ebp - 0x14]
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [0x4060f0]
call sub.kernel32.dll_WriteConsoleOutputA
inc dword [0x406240]
mov eax, dword [0x406240]
cmp eax, dword [0x4061e0]
jle 0x401cef
mov edi, dword [0x4061c0]
mov dword [0x406240], edi
inc dword [0x406230]
jmp 0x401cef
push 1
call fcn.00401da8
dec dword [0x406230]
mov eax, dword [0x406230]
cmp eax, dword [0x4061f0]
jg 0x401ce2
leave
ret 4
Function at 0x401ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408d7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_3
push ecx
lea eax, [esi + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00405d30
mov edi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00401d30
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4a3e0d
Capabilities:
Encode data using xor

Disassembly:
push eax
sal esi, 0xfc
or al, 0xe4
add ah, bl
pop es
daa
cld
inc edi
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
adc eax, 0xc84ec7f7
ja 0x4a3e36
xchg esp, eax
xor al, 0x7a
push 0xff6ab1d4
xchg dword [esi + 0x144916cf], ebp
and al, byte [esi + 0x1780f0bb]
pop ss
jnp 0x4a3e24
insd dword es:[edi], dx
push 0x531647e0
or eax, 0x42c1637f
insb byte es:[edi], dx
or dword [0x45eb8134], esi
push 0x3277b1ec
jno 0x4a3e65
popal
push ebx
int3
mov byte [esi + 0x21ebe253], al
push 0x3bd2b204
bound edx, qword fs:[ebx + 0x3147d023]
dec eax
pop esi
pushfd
sti
mov eax, esi
lcall 0xa04, 0x238075a6
or byte [eax], cl
or al, 0x69
lcall 0x1410, 0x100c69a6
adc al, 0xa6
imul ebx, dword [edx + 0x1c1818a6], 0xa69a201c
imul ebx, dword [edx + 0x28242420], 0x9a692c28
cmpsb byte [esi], byte es:[edi]
imul ebp, dword [eax + esi], 0xf343430
int1
mov dh, byte [esi + 0x380c5738]
adc al, 0x3c
lea edi, [esi + 0x3c]
leave
inc ebx
imul ebx, dword [edx + 0x2040b5a6], 0x44440a40
dec eax
dec eax
cmpsb byte [esi], byte es:[edi]
imul ebx, dword [edx + 0x504c4ca6], 0xa69a5450
imul ebx, dword [edx + 0x5c585854], 0x34d2605c
lodsd eax, dword [esi]
imul esp, dword [eax + 0x64], 0x6868648c
xor dword [ecx + 0x22c631a4], 0x50d457c
invalid

Function at 0x4c0d07
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 4], ebx
cmp dword [ebx + 0xe4], 4
jle 0x4c0d2e
mov ecx, dword [ebx + 0x1c]
push 1
push 0xd05
mov eax, dword [ecx]
call dword [eax + 0x194]
mov ecx, dword [ebx + 0x1c]
xor edi, edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
mov eax, dword [ecx]
push 0x1401
push 0x1908
push dword [ebp + 0x10]
push esi
push edi
push edi
call dword [eax + 0x19c]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xe4]
cmp edx, 4
jle 0x4c0d71
mov ecx, dword [ecx + 0x1c]
push edx
push 0xd05
mov eax, dword [ecx]
call dword [eax + 0x194]
imul esi, dword [ebp + 0x10]
shl esi, 2
cmp dword [ebp + 0x14], 1
jne 0x4c0d97
test esi, esi
je 0x4c0d97
mov al, byte [edi + ebx + 2]
mov cl, byte [edi + ebx]
mov byte [edi + ebx], al
mov byte [edi + ebx + 2], cl
add edi, 4
cmp edi, esi
jb 0x4c0d82
cmp dword [ebp + 0x18], 1
jne 0x4c0e30
test esi, esi
je 0x4c0e30
mov ecx, 0xff
lea edi, [esi - 1]
shr edi, 2
inc ebx
mov dword [ebp + 8], ecx
inc edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], ecx
movzx esi, byte [ebx + 2]
movzx eax, byte [ebx - 1]
imul eax, esi
cdq
idiv ecx
lea edx, [ebp + 8]
cmp eax, 0xff
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0x10]
cmovge ecx, edx
mov al, byte [ecx]
mov ecx, 0xff
mov byte [ebx - 1], al
movzx eax, byte [ebx]
imul eax, esi
cdq
idiv ecx
lea edx, [ebp + 0xc]
cmp eax, 0xff
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0x10]
cmovge ecx, edx
mov al, byte [ecx]
lea ecx, [ebp + 0x10]
mov byte [ebx], al
lea ebx, [ebx + 4]
movzx eax, byte [ebx - 3]
imul eax, esi
mov esi, 0xff
cdq
idiv esi
lea edx, [ebp + 0x14]
cmp eax, esi
mov dword [ebp + 0x10], eax
cmovge ecx, edx
mov al, byte [ecx]
mov ecx, esi
mov byte [ebx - 3], al
dec edi
jne 0x4c0dbf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4c606e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4c609b
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub esi, ecx
mov eax, dword [esi + ecx]
rol eax, 0x10
xor eax, dword [esi + ecx]
and eax, 0xff00ff
xor eax, dword [esi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4c6081
pop esi
pop ebp
ret
Function at 0x4fca00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp byte [0x121c80be], 0
jne 0x4fca3e
push esi
mov esi, edi
push dword [ebp + 0xc]
push dword [esi*4 + 0x1217f184]
call fcn.004fcc9a
pop ecx
pop ecx
test al, al
jne 0x4fca2f
inc esi
cmp esi, 2
jb 0x4fca12
jmp 0x4fca36
mov edi, dword [esi*4 + 0x1217f184]
mov byte [0x121c80be], 1
pop esi
push dword [ebp + 8]
call 0xff816680
pop ecx
cmp eax, 0xcc
jl 0x4fca67
cmp eax, 0xcd
jle 0x4fca70
mov ecx, 0xce
cmp eax, ecx
je 0x4fca6c
jle 0x4fca67
cmp eax, 0xd0
jle 0x4fca70
xor eax, eax
pop edi
pop ebp
ret
mov eax, edi
jmp 0x4fca69
mov eax, dword [0x1217f18c]
jmp 0x4fca69
Function at 0x507898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0xc]
lea eax, [esi + 0x38]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
cmp edi, 4
jg 0x5078de
cmp edi, 2
setle bl
add ebx, 2
jmp 0x5078e4
cmp edi, 0x10
setle bl
xor eax, eax
push ecx
inc eax
mov ecx, ebx
shl eax, cl
dec eax
add eax, edx
shr eax, cl
push eax
push esi
call fcn.00506c93
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x507a0d
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cdq
push 1
push edx
push eax
call 0xffa7b7c7
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
jne 0x507929
inc eax
jmp 0x507a1b
push eax
push ebx
push dword [ebp - 0xc]
lea eax, [esi + 0x38]
push dword [ebp - 4]
push edi
push eax
push dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x38]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00507143
mov ebx, dword [ebp + 8]
push 1
push 1
push ebx
call 0x695bd9
push 3
push 2
push ebx
call 0x695bd9
add esp, 0x40
lea eax, [edi - 1]
push eax
push 8
push ebx
call 0x695bd9
lea eax, [edi - 1]
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, 1
jl 0x5079e8
mov ebx, dword [ebp - 0x1c]
mov ecx, 0xff00ff00
mov edi, dword [ebx + eax*4]
mov edx, edi
mov esi, dword [ebx + eax*4 - 4]
and edx, 0xff00
mov eax, esi
and eax, ecx
mov ecx, edi
sub edx, eax
and ecx, 0xffff00ff
mov eax, esi
sub edx, 0xff01
and eax, 0xff00ff
sub ecx, eax
mov eax, 0xff00ff
add ecx, 0xff00
xor edx, ecx
mov ecx, 0xff00ff00
and edi, ecx
and esi, ecx
sub edi, esi
and edx, eax
add edi, eax
mov eax, dword [ebp - 4]
xor edx, edi
mov dword [ebx + eax*4], edx
dec eax
mov dword [ebp - 4], eax
cmp eax, 1
jge 0x507986
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
lea eax, [esi + 0x438]
push 1
push edi
push eax
lea eax, [esi + 0x468]
push eax
lea eax, [esi + 0x38]
push eax
push ebx
call fcn.00507725
add esp, 0x1c
mov esi, eax
jmp 0x507a10
mov esi, dword [ebp - 0x14]
push dword [ebp - 8]
call 0xff73012f
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5088fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x12173220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], eax
call 0x695ae8
mov ebx, dword [esi + 4]
add ebx, 7
mov dword [ebp - 0x2c], eax
sar ebx, 3
sub ebx, dword [esi + 8]
add ebx, dword [esi + 0xc]
push edi
push 0x15
mov dword [ebp - 0x1c], 0x46464952
lea ecx, [ebx + 1]
mov dword [ebp - 0x14], 0x50424557
mov esi, ecx
mov dword [ebp - 0x10], 0x4c385056
lea edx, [ecx + 0xc]
mov byte [ebp - 8], 0x2f
and esi, 1
add edx, esi
movzx eax, dx
mov byte [ebp - 0x18], al
sar eax, 8
mov byte [ebp - 0x17], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x16], al
sar eax, 8
mov byte [ebp - 0x15], al
movzx eax, cx
mov byte [ebp - 0xc], al
sar eax, 8
shr ecx, 0x10
mov byte [ebp - 0xb], al
lea eax, [ebp - 0x1c]
mov byte [ebp - 0xa], cl
sar ecx, 8
push eax
mov dword [ebp - 0x24], edx
mov byte [ebp - 9], cl
call dword [edi + 0x48]
add esp, 0x10
test eax, eax
je 0x5089d6
push edi
push ebx
push dword [ebp - 0x2c]
call dword [edi + 0x48]
add esp, 0xc
test eax, eax
je 0x5089d6
test esi, esi
je 0x5089c7
push edi
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push 1
push eax
call dword [edi + 0x48]
add esp, 0xc
test eax, eax
je 0x5089d6
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add eax, 8
mov dword [ecx], eax
xor eax, eax
jmp 0x5089d9
push 8
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0xec9ec
mov esp, ebp
pop ebp
ret
Function at 0x508ee1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebx]
imul eax, edi, 3
add eax, dword [ebp + 8]
imul esi, eax, 0x2c
add esi, dword [ebx + 0x14]
cmp dword [ebx + 4], 0
jge 0x508ff8
push esi
push 0
call fcn.00508b23
pop ecx
pop ecx
xor eax, eax
jmp 0x509013
push esi
push 1
call fcn.00508b23
jmp 0x508f38
push 0
inc edi
call fcn.00508b23
movzx eax, byte [edi + 0x11d94bd4]
imul esi, eax, 0x84
add esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
pop ecx
pop ecx
movsx eax, word [eax + edi*2]
test eax, eax
mov dword [ebp + 8], eax
lea eax, [esi + 4]
push eax
je 0x508f20
inc edi
push 1
mov dword [ebp - 0xc], edi
call fcn.00508b23
lea eax, [esi + 8]
push eax
mov eax, dword [ebp + 8]
inc eax
push 2
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
push eax
call fcn.00508b23
add esp, 0x10
test eax, eax
jne 0x508f7d
mov esi, dword [ebx + 0x14]
add esi, 0x2c
jmp 0x508fe9
mov eax, dword [ebp + 8]
cdq
xor eax, edx
sub eax, edx
push 0x43
pop ecx
cmp eax, ecx
cmovg eax, ecx
and dword [ebp - 4], 0
movzx ecx, word [eax*4 + 0x11d95e4e]
movzx eax, word [eax*4 + 0x11d95e4c]
shr eax, 1
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
je 0x508fe3
mov ebx, dword [ebp - 4]
add esi, 0xc
mov edi, ecx
test al, 1
je 0x508fd2
push esi
push 2
pop eax
mov ecx, ebx
shl eax, cl
and eax, edi
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00508b23
mov eax, dword [ebp + 8]
pop ecx
pop ecx
inc ebx
add esi, 4
sar eax, 1
mov dword [ebp + 8], eax
jne 0x508fb3
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebx + 0x14]
add esi, 0x58
movzx eax, byte [edi + 0x11d94bd4]
imul ecx, eax, 0x84
add esi, ecx
cmp edi, dword [ebx + 4]
jle 0x508f16
cmp edi, 0x10
jge 0x509010
push esi
push 0
call fcn.00508b23
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret