joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4985b4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4986a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebx + 9]
call fcn.004051d8
lea eax, [ebx + 0xd]
call fcn.004051d8
mov eax, dword [ebx + 0x11]
test eax, eax
je 0x4985ff
call fcn.00402fcc
xor eax, eax
mov dword [ebx + 0x11], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405668
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
mov eax, dword [ebp - 0xc]
call fcn.00402fb0
mov esi, eax
mov eax, dword [ebp - 0x10]
call fcn.00402fb0
mov edi, eax
test esi, esi
je 0x498690
test edi, edi
je 0x498690
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405668
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x498690
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.0040b5d8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 9]
call fcn.0040522c
lea eax, [ebx + 0xd]
mov edx, dword [ebp - 4]
call fcn.0040522c
mov dword [ebx + 0x11], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4986ad
lea eax, [ebp - 0x18]
call fcn.004051d8
ret

Function at 0x498c04
Capabilities:
Manipulate user privileges

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, esp
xor ecx, ecx
mov edx, 8
call fcn.00403818
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.00498ba4
test al, al
je 0x498c4c
push 1
lea eax, [esp + 4]
push eax
mov eax, dword [esi + 0x11]
push eax
mov eax, dword [esi + 5]
push eax
call sub.advapi32.dll_LsaAddAccountRights
push eax
call sub.advapi32.dll_LsaNtStatusToWinError
test eax, eax
sete bl
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x498c54
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x498d4e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x11], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x498d30
or esi, 0xffffffff
xor edi, edi
mov dword [ebp - 0xc], 1
cmp dword [ebx + 9], 0
je 0x498cb3
push dword [ebx + 9]
push 0x498d68
push dword [ebx + 0xd]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040556c
jmp 0x498cbe
lea eax, [ebp - 4]
mov edx, dword [ebx + 0xd]
call fcn.00405270
mov eax, dword [ebp - 4]
call fcn.004864b0
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x14]
push edx
push esi
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 0xc]
push edx
push edi
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x498d21
mov esi, dword [ebp - 0x14]
dec esi
test esi, esi
jl 0x498d21
inc esi
xor edi, edi
mov ebx, edi
add ebx, ebx
add ebx, ebx
add ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x498d1d
lea eax, [ebp - 0x1c]
mov edx, dword [ebx]
call fcn.00405400
mov eax, dword [ebp - 0x1c]
mov edx, 0x498d74
call fcn.00409ec0
test al, al
je 0x498d1d
mov byte [ebp - 5], 1
jmp 0x498d30
inc edi
dec esi
jne 0x498cef
cmp dword [ebp - 0x10], 0
je 0x498d30
mov eax, dword [ebp - 0x10]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498d55
lea eax, [ebp - 0x1c]
call fcn.004051d8
lea eax, [ebp - 4]
call fcn.004051d8
ret

Function at 0x498d84
Capabilities:
Add user account to group

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, 0x498dc8
call fcn.004864b0
mov edx, dword [ebx + 0x11]
mov dword [esp], edx
push 1
lea edx, [esp + 4]
push edx
push 0
push eax
push 0
call sub.netapi32.dll_NetLocalGroupAddMembers
test eax, eax
je 0x498db9
cmp eax, 0x562
je 0x498db9
xor eax, eax
pop edx
pop ebx
ret
mov al, 1
pop edx
pop ebx
ret
Function at 0x499084
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff24
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4992e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004051d8
mov eax, esi
call fcn.004051d8
mov dl, 1
mov eax, dword [0x4982c4]
call fcn.00498394
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4992c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 4]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4992b0
lea eax, [ebp - 0xd9]
xor ecx, ecx
mov edx, 0xc9
call fcn.00403818
mov dword [ebp - 0x10], 0xc9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xd9]
push eax
call sub.advapi32.dll_GetUserNameA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4992b0
lea edx, [ebp - 4]
lea eax, [ebp - 0xd9]
call fcn.0040b5d8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004985b4
test al, al
je 0x49914d
mov eax, dword [ebp - 0xc]
call fcn.00498c54
test al, al
jne 0x499151
xor eax, eax
jmp 0x499153
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4992b0
push 0x499300
mov ecx, 0x499368
mov edx, 0x499384
mov eax, dword [ebp - 0xc]
call fcn.00498510
test al, al
je 0x499187
mov eax, dword [ebp - 0xc]
call fcn.00498d84
test al, al
jne 0x49918b
xor eax, eax
jmp 0x49918d
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4992b0
mov edx, 0x49939c
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x4993bc
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x4993d8
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x499400
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x49941c
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x49943c
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x499458
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x499474
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x499498
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
je 0x49924c
mov edx, 0x4994b8
mov eax, dword [ebp - 0xc]
call fcn.00498c04
test al, al
jne 0x499250
xor eax, eax
jmp 0x499252
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x49926c
test edi, edi
je 0x49926c
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00498fec
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x499292
cmp dword [ebp + 8], 0
je 0x499292
mov eax, dword [ebp + 8]
mov edx, edi
call fcn.00405600
je 0x499292
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.00498fec
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4992b0
mov eax, ebx
mov edx, 0x499384
call fcn.0040522c
mov eax, esi
mov edx, 0x499368
call fcn.0040522c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4992cd
mov eax, dword [ebp - 0xc]
call fcn.004042bc
ret
Function at 0x499964
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4999ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x105]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4999ca
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00405448
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.00411570
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.0040522c
jmp 0x4999d1
mov eax, ebx
call fcn.004051d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4999f1
lea eax, [ebp - 0x10c]
call fcn.004051d8
ret

Function at 0x4999f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x499a7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x2e
lea eax, [ebp - 0x105]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x499a5e
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00405448
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.00411570
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.0040522c
jmp 0x499a65
mov eax, ebx
call fcn.004051d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499a85
lea eax, [ebp - 0x10c]
call fcn.004051d8
ret
Function at 0x49dad4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x49daf8
mov eax, ebx
call fcn.0049d3bc
mov eax, ebx
call fcn.0049d380
jmp 0x49dc7f
mov eax, esi
mov edx, dword [0x49c6a8]
call fcn.00404448
test al, al
je 0x49db22
mov edi, esi
mov edx, edi
mov eax, ebx
call fcn.0049da30
mov edx, edi
mov eax, ebx
call fcn.0049d9d4
jmp 0x49dc7f
mov eax, esi
mov edx, dword [0x44ae14]
call fcn.00404448
test al, al
je 0x49db8f
mov eax, ebx
call fcn.0049d380
call fcn.0044b42c
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x49db88
push dword fs:[edx]
mov dword fs:[edx], esp
push 2
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov dx, 2
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dc7f
call fcn.0044b42c
mov edx, dword [eax]
call dword [edx + 0x14]
ret
mov eax, esi
mov edx, dword [0x42da1c]
call fcn.00404448
test al, al
je 0x49dbfe
mov eax, ebx
call fcn.0049d380
mov edi, esi
mov eax, edi
call fcn.00434cac
cmp al, 8
jne 0x49dbbf
mov dl, 1
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x70]
jmp 0x49dbc8
xor edx, edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x68]
mov edx, eax
mov eax, ebx
call fcn.0049e2b8
mov eax, edi
call fcn.00434cac
add al, 0xfe
sub al, 2
jae 0x49dc7f
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x24]
mov edx, eax
mov eax, ebx
call fcn.0049dfac
jmp 0x49dc7f
mov eax, esi
mov edx, dword [0x42d574]
call fcn.00404448
test al, al
je 0x49dc76
mov eax, ebx
call fcn.0049d380
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 8], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edi, eax
mov dword [ebp - 4], edi
push 5
push 0
push 0
push 0
mov ecx, edi
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x7c]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
imul edx, dword [ebx + 0x868]
mov eax, dword [ebx + 0x30]
xor ecx, ecx
call fcn.00403818
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x86c]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x14]
jmp 0x49dc7f
mov edx, esi
mov eax, ebx
call fcn.00421250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0ca4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x11], 0xca
jne 0x4b0cd4
push ebx
call fcn.004b6d84
cmp byte [ebx + 0x3d], 0
pop ecx
je 0x4b0ccd
mov dword [ebx + 0x11], 0xcf
mov al, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x11], 0xcb
cmp dword [ebx + 0x11], 0xcb
jne 0x4b0d40
mov edx, dword [ebx + 0x183]
cmp byte [edx + 0x10], 0
je 0x4b0d38
cmp dword [ebx + 8], 0
je 0x4b0cf6
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x183]
call dword [eax]
pop ecx
test eax, eax
jne 0x4b0d09
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0x4b0d38
cmp dword [ebx + 8], 0
je 0x4b0ce9
cmp eax, 3
je 0x4b0d1c
dec eax
jne 0x4b0ce9
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b0ce9
mov edx, dword [ebx + 0x10f]
add dword [eax + 8], edx
jmp 0x4b0ce9
mov ecx, dword [ebx + 0x72]
mov dword [ebx + 0x7a], ecx
jmp 0x4b0d5e
cmp dword [ebx + 0x11], 0xcc
je 0x4b0d5e
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x11]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.004b0d68
pop ecx
pop ebx
pop ebp
ret

Function at 0x4b0d68
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x11], 0xcc
je 0x4b0ded
push ebx
mov eax, dword [ebx + 0x173]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x6e], edx
mov dword [ebx + 0x11], 0xcc
jmp 0x4b0ded
mov eax, dword [ebx + 8]
test eax, eax
je 0x4b0daa
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x56]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x6e]
lea eax, [ebx + 0x6e]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x177]
call dword [edx + 4]
add esp, 0x10
cmp esi, dword [ebx + 0x6e]
jne 0x4b0dcb
xor eax, eax
jmp 0x4b0e0a
mov edx, dword [ebx + 0x6e]
cmp edx, dword [ebx + 0x56]
jb 0x4b0d93
push ebx
mov ecx, dword [ebx + 0x173]
call dword [ecx + 4]
pop ecx
push ebx
mov eax, dword [ebx + 0x173]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x6e], edx
mov ecx, dword [ebx + 0x173]
cmp byte [ecx + 8], 0
jne 0x4b0dcb
cmp byte [ebx + 0x3e], 0
mov eax, 0xce
jne 0x4b0e05
dec eax
mov dword [ebx + 0x11], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4d77d8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0x4d796e
mov ecx, dword [edx]
xor ebx, ebx
mov dword [ebp - 4], ecx
xor esi, esi
test byte [edx + 8], 2
je 0x4d7831
movzx edi, byte [eax]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
movzx edi, byte [eax + 1]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
xor ecx, ecx
movzx edi, byte [eax + 2]
inc ebx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x4d7841
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x4d7857
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x4d7877
cmp dword [eax], 0
jg 0x4d786b
xor edi, edi
mov dword [eax], edi
jmp 0x4d786f
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x4d7860
test si, si
je 0x4d796e
mov al, byte [edx + 9]
sub al, 2
je 0x4d789c
sub al, 2
je 0x4d78bc
sub al, 4
je 0x4d78f7
sub al, 8
je 0x4d791e
jmp 0x4d796e
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x4d796e
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x4d78ac
jmp 0x4d796e
mov esi, dword [ebp - 0x20]
mov ebx, 0xf0
mov ecx, esi
mov edx, dword [edx + 4]
sar ebx, cl
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
and bl, 0xf0
or bl, cl
xor esi, esi
cmp edx, esi
mov eax, dword [ebp + 0xc]
jbe 0x4d796e
mov ecx, dword [ebp - 0x20]
inc esi
shr byte [eax], cl
and byte [eax], bl
inc eax
cmp edx, esi
ja 0x4d78e8
jmp 0x4d796e
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0x4d796e
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x4d7909
jmp 0x4d796e
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x4d796e
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
xor edx, edx
add si, ax
mov eax, dword [ebp - 0xc]
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov edx, esi
mov byte [edi], al
inc edi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0x4d7936
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e40a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x628f60
test edx, edx
jne 0x4e40c2
xor eax, eax
jmp 0x4e41aa
xor eax, 0xffffffff
cmp ebx, 8
jb 0x4e418a
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ebx, 8
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
cmp ebx, 8
mov eax, esi
jae 0x4e40ce
test ebx, ebx
je 0x4e41a7
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
dec ebx
mov eax, esi
jne 0x4e418e
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret
Function at 0x4e500c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x22]
mov eax, dword [ebx + 0x32]
sub eax, dword [ebx + 0x6a]
sub eax, dword [ebx + 0x62]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e5041
cmp dword [ebx + 0x62], 0
jne 0x4e5041
cmp dword [ebx + 0x6a], 0
jne 0x4e5041
mov dword [ebp - 8], esi
jmp 0x4e50d0
cmp dword [ebp - 8], 0xffffffff
jne 0x4e504f
dec dword [ebp - 8]
jmp 0x4e50d0
mov edx, dword [ebx + 0x22]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x62]
ja 0x4e50d0
push esi
mov eax, dword [ebx + 0x2e]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.004c9588
add esp, 0xc
sub dword [ebx + 0x66], esi
sub dword [ebx + 0x62], esi
sub dword [ebx + 0x52], edi
mov eax, dword [ebx + 0x42]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3a]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4e509d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4e509f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e5086
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x36]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4e50c5
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4e50c7
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e50ae
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x4e5132
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x2e]
add edx, dword [ebx + 0x62]
add edx, dword [ebx + 0x6a]
push edx
push edi
call fcn.004e4da4
add esp, 0xc
add dword [ebx + 0x6a], eax
cmp dword [ebx + 0x6a], 3
jb 0x4e511d
mov ecx, dword [ebx + 0x2e]
mov eax, dword [ebx + 0x62]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x3e], eax
mov ecx, dword [ebx + 0x4e]
shl eax, cl
mov edx, dword [ebx + 0x2e]
mov ecx, dword [ebx + 0x62]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4a]
mov dword [ebx + 0x3e], eax
cmp dword [ebx + 0x6a], 0x106
jae 0x4e5132
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4e501b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f8450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004f823c
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004f823c
pop ecx
mov ebx, eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1014]
mov ecx, ebx
mov edx, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x7c]
dec ebx
test ebx, ebx
jl 0x4f84d9
inc ebx
mov dword [ebp - 8], ebx
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [eax - 0x1018], 8
mov ebx, dword [ebp - 4]
dec ebx
test ebx, ebx
jl 0x4f84d3
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
push eax
call fcn.004f81d8
pop ecx
xor al, 1
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1014]
mov ecx, edi
mov edx, esi
call fcn.0049ed74
inc esi
dec ebx
jne 0x4f84b0
inc edi
dec dword [ebp - 8]
jne 0x4f8498
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f8994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f8a99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, 0x4f8ab0
call fcn.004f87cc
pop ecx
mov eax, dword [ebp + 8]
push eax
mov eax, 0x4f8abc
call fcn.004f87cc
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x4f8ae8
call fcn.0040be64
mov eax, dword [ebp - 8]
call fcn.004f87cc
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f8a77
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f8a71
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1018]
mov ecx, edi
mov edx, esi
call fcn.0049ed0c
xor al, 1
movzx eax, al
call fcn.004f8868
pop ecx
inc esi
dec ebx
jne 0x4f8a4c
inc edi
dec dword [ebp - 4]
jne 0x4f8a34
mov eax, dword [ebp + 8]
push eax
mov al, 0xa
call fcn.004f8768
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8aa0
lea eax, [ebp - 8]
call fcn.004051d8
ret