joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bed98
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4befd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004be170
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x522d38], eax
mov eax, dword [ebp - 0xc]
mov dword [0x522d3c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x522d40], eax
mov eax, dword [0x527e78]
cmp dword [eax], 2
sete byte [0x5224d8]
push 0x4befe0
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004bdd60
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x5224d8], 0
jne 0x4bee27
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004bdea4
test al, al
je 0x4bee27
mov eax, dword [ebp - 0x4c]
mov dword [0x52beb8], eax
jmp 0x4bee2e
xor eax, eax
mov dword [0x52beb8], eax
call fcn.004be964
and eax, 0x7f
cmp eax, 0x18
ja case.0x4bee3f.0
jmp dword [eax*4 + 0x4bee46]
mov byte [0x5224c4], 1
jmp case.0x4bee3f.0
mov byte [0x5224c8], 1
jmp case.0x4bee3f.0
mov byte [0x5224cc], 1
jmp case.0x4bee3f.0
mov byte [0x5224d0], 1
jmp case.0x4bee3f.0
mov byte [0x5224d4], 1
jmp case.0x4bee3f.0
mov byte [0x5224dc], 1
mov byte [0x5224e0], 1
jmp case.0x4bee3f.0
mov byte [0x5224dc], 1
mov byte [0x5224e4], 1
jmp case.0x4bee3f.0
mov byte [0x5224dc], 1
mov byte [0x5224e4], 1
mov byte [0x5224e8], 1
jmp case.0x4bee3f.0
mov byte [0x5224ec], 1
jmp case.0x4bee3f.0
mov byte [0x5224f0], 1
jmp case.0x4bee3f.0
mov byte [0x5224f4], 1
jmp case.0x4bee3f.0
mov byte [0x5224f8], 1
jmp case.0x4bee3f.0
mov byte [0x5224fc], 1
jmp case.0x4bee3f.0
mov byte [0x522500], 1
jmp case.0x4bee3f.0
mov byte [0x522504], 1
jmp case.0x4bee3f.0
mov byte [0x522508], 1
jmp case.0x4bee3f.0
mov byte [0x52250c], 1
jmp case.0x4bee3f.0
mov byte [0x522510], 1
jmp case.0x4bee3f.0
mov byte [0x522514], 1
jmp case.0x4bee3f.0
mov byte [0x522518], 1
jmp case.0x4bee3f.0
mov byte [0x52251c], 1
jmp case.0x4bee3f.0
mov byte [0x522520], 1
jmp case.0x4bee3f.0
mov byte [0x522524], 1
jmp case.0x4bee3f.0
mov byte [0x522528], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4befd9
lea eax, [ebp - 4]
call fcn.004051e8
ret

Function at 0x4c1350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4c13b4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405458
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00409e64
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c13bb
lea eax, [ebp - 0xc]
call fcn.004051e8
ret
Function at 0x4c1b18
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4c1b2d
add esp, 0xfffffff0
call fcn.004045ec
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00404298
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.0040523c
mov eax, esi
call fcn.004056ac
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA_1
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4c1b81
mov ecx, dword [0x527ce0]
mov dl, 1
mov eax, dword [0x4c199c]
call fcn.004bb3f8
call fcn.00404b3c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c1ba8
call fcn.00404644
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4c5998
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
call sub.kernel32.dll_GetCurrentProcess
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x28
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x18]
push eax
push 0x4c5a64
push 0x4c5a78
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
lea eax, [ebp - 0x18]
push eax
push 0x4c5a7c
push 0x4c5a78
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0xa
call sub.kernel32.dll_Sleep_1
push 0
push 6
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4c5a90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4c5c28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c5be3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00402d48
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c5bcc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4c5c38
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409dd8
push dword [ebp - 0x20]
push 0x4c5c44
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409dd8
push dword [ebp - 0x24]
push 0x4c5c44
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00409dd8
push dword [ebp - 0x28]
push 0x4c5c44
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00409dd8
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040556c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4c5c38
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0xc]
call fcn.00402d64
jmp 0x4c5bd9
lea eax, [ebp - 0x1c]
mov edx, 0x4c5c50
call fcn.00405280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5bfa
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
call fcn.0040523c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5c2f
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.0040520c
lea eax, [ebp - 4]
call fcn.004051e8
ret
Function at 0x4c6b90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040569c
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4c6d77
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 2
mov eax, dword [ebp - 4]
call fcn.004c6fa0
test al, al
je 0x4c6d5c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28], 2
jne 0x4c6be3
mov dword [ebp - 0x1c], 0xac100129
jmp 0x4c6bea
mov dword [ebp - 0x1c], 0xac100126
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6d5c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004c7588
test al, al
je 0x4c6d5c
cmp dword [ebp - 0x14], 0x20000000
jne 0x4c6d5c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004969fc
test al, al
je 0x4c6d5c
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00497684
test al, al
je 0x4c6d5c
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x18]
je 0x4c6c60
cmp dword [ebp + 0x18], 0
jne 0x4c6d49
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
cmp byte [ebp + 8], 0
je 0x4c6cdd
mov eax, dword [ebp - 0xc]
call fcn.0047b848
cmp eax, dword [ebp - 0x18]
jne 0x4c6cdd
mov eax, dword [ebp - 0xc]
call fcn.0040a2a8
test al, al
je 0x4c6cdd
mov byte [ebp - 0x1d], 0
mov edx, 0x15000001
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6d5c
mov eax, dword [ebp - 0xc]
call fcn.0047b358
shrd eax, edx, 0xa
shr edx, 0xa
shld edx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x28]
mov ecx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004975c0
test al, al
je 0x4c6d5c
cmp byte [ebp - 0x1d], 0
je 0x4c6cf4
mov edx, 0x15000000
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6d5c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004963f4
test al, al
je 0x4c6d26
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0047b7a0
jmp 0x4c6d5c
cmp byte [ebp + 8], 0
je 0x4c6d39
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0047b7a0
jmp 0x4c6d5c
mov eax, dword [ebp - 0xc]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4c6d5c
mov byte [ebp - 0xd], 0
mov edx, 0x10000000
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6d7e
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040520c
ret
Function at 0x4c6df4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040569c
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4c6f2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
call fcn.004c6fa0
test al, al
je 0x4c6f12
cmp dword [ebp + 8], 0
jne 0x4c6e52
mov edx, 0xac100102
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6f12
jmp 0x4c6e67
mov edx, 0xac10013f
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6f12
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004c7588
test al, al
je 0x4c6f12
cmp dword [ebp - 0x14], 0x20000000
jne 0x4c6f12
mov eax, dword [ebp - 8]
call fcn.00481c80
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x28]
mov ecx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00497684
test al, al
je 0x4c6f12
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x1c]
jne 0x4c6ebe
cmp eax, dword [ebp - 0x20]
jbe 0x4c6f02
jmp 0x4c6ec0
jle 0x4c6f02
mov edx, 0x15000000
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c6f12
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004963f4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4c6f12
mov eax, dword [ebp - 0xc]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4c6f12
mov edx, 0x20000000
mov eax, dword [ebp - 4]
call fcn.004c755c
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6f34
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040520c
ret
Function at 0x4c6fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004961a4
imul eax, eax, 0x3e8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3e8
jge 0x4c6fcd
mov dword [ebp - 0x10], 0x2710
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x38]
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 0x10]
jge 0x4c6ffa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00496a9c
test al, al
je 0x4c6ffa
mov byte [ebp - 5], 1
jmp 0x4c70a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00496a9c
test al, al
jne 0x4c7037
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7174
test al, al
jne 0x4c7021
mov byte [ebp - 5], 1
jmp 0x4c709a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7174
test al, al
sete byte [ebp - 5]
jmp 0x4c709a
mov byte [ebp - 5], 0
mov edx, 0x11110000
mov eax, dword [ebp - 4]
call fcn.004c755c
test al, al
je 0x4c7068
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004c7588
test al, al
je 0x4c7068
cmp dword [ebp - 0xc], 0x99991112
jne 0x4c7068
mov byte [ebp - 5], 1
cmp byte [ebp - 5], 0
jne 0x4c709a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7174
test al, al
jne 0x4c7086
mov byte [ebp - 5], 1
jmp 0x4c709a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7174
test al, al
sete byte [ebp - 5]
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4ceff4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 0x14]
mov edx, dword [ebp - 0x20]
mov dword [ebp + edx*4 - 0x160], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jne 0x4cf006
mov dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x16c]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp + edx*4 - 0x180]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp + edx*4 - 0x198]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp + edx*4 - 0x1a0]
mov edx, 1
call fcn.004c94d0
mov edx, dword [ebp - 0x20]
mov dword [ebp + edx*4 - 0x160], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x50
jne 0x4cf02a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x14
cdq
idiv ecx
mov ebx, dword [eax*4 + 0x5239d8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call ebx
mov ebx, eax
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.004c94d0
add ebx, eax
add ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add ebx, dword [ebp + eax*4 - 0x160]
mov eax, dword [ebp - 0x20]
mov ecx, 0x14
cdq
idiv ecx
add ebx, dword [eax*4 + 0x5239c8]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, 0x1e
mov eax, dword [ebp - 0xc]
call fcn.004c94d0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x50
jne 0x4cf0a0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
add dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
add dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add dword [eax + 0x10], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cf308
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xc3d2e1f0
pop ecx
pop ebp
ret
Function at 0x4cf83c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov ecx, 0x10
call fcn.00403014
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov ecx, 0x10
call fcn.00403014
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x28], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
jne 0x4cf870
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax + str._.C]
mov edx, dword [ebp - 0x14]
xor byte [ebp + edx - 0x48], al
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x48]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x30
jne 0x4cf8a1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
and eax, 0xff
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
jne 0x4cf89c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x48]
mov ecx, 0x10
call fcn.00403014
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0xf]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x18]
mov al, byte [eax + str._.C]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor byte [edx + ecx], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
jne 0x4cf8fb
mov esp, ebp
pop ebp
ret

Function at 0x4d01ec
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x10325476
pop ecx
pop ebp
ret

Function at 0x4d0ebc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret
Function at 0x4d2fe0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x5c
call fcn.00403a94
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xc3d2e1f0
pop ecx
pop ebp
ret

Function at 0x4d6da8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d6e97
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.004d76ac
call fcn.004d766c
test al, al
jne 0x4d6ded
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x4d6eac
call fcn.004054f8
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d6e08
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x4d6e2e
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
xor byte [ebp - 0xd], al
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4d6e19
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
xor edx, edx
mov dl, byte [ebp - 0xd]
shr edx, 4
mov dl, byte [edx + str.ABCDEFGHIJKLMNOP]
call fcn.004053d0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
mov dl, byte [ebp - 0xd]
and dl, 0xf
and edx, 0xff
mov dl, byte [edx + str.ABCDEFGHIJKLMNOP]
call fcn.004053d0
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov edx, 3
call fcn.0040556c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6e9e
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040520c
lea eax, [ebp - 8]
call fcn.004051e8
ret
Function at 0x4d6f3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4d70dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x527b70]
mov eax, dword [eax]
call fcn.004662e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a714
lea eax, [ebp - 0x1c]
mov edx, 0x4d70f4
call fcn.004054b4
mov eax, dword [ebp - 0x1c]
call fcn.004056ac
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x52da64], eax
cmp dword [0x52da64], 0
je 0x4d70c2
push 0x4d7104
mov eax, dword [0x52da64]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52da68], eax
cmp dword [0x52da68], 0
je 0x4d70b1
call fcn.004032d4
mov eax, 0xffff
call fcn.004032fc
mov word [ebp - 2], ax
mov eax, dword [0x527b7c]
mov esi, eax
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx eax, word [ebp - 2]
xor dword [ebp - 0x18], eax
mov ax, word [ebp - 2]
xor word [ebp - 0x14], ax
mov ax, word [ebp - 2]
xor word [ebp - 0x12], ax
xor eax, eax
mov dword [ebp - 8], eax
mov al, byte [ebp - 2]
mov edx, dword [ebp - 8]
xor byte [ebp + edx - 0x10], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 8
jne 0x4d7000
mov eax, 0x52da6c
mov edx, 0x7c
call fcn.00467478
mov edx, 0x52da6c
mov ax, 0xffff
sub ax, word [ebp - 2]
mov ecx, 0x7a
call fcn.00467438
mov word [0x52dae6], ax
push 0x52da6c
lea eax, [ebp - 0x18]
push eax
mov ax, word [ebp - 2]
push eax
call dword [0x52da68]
test al, al
jne 0x4d706a
mov eax, 0x52da6c
xor ecx, ecx
mov edx, 0x7c
call fcn.00403a94
jmp 0x4d70c2
mov edx, 0x52da6c
mov ecx, 0x7a
mov ax, word [ebp - 2]
call fcn.00467438
cmp ax, word [0x52dae6]
je 0x4d7099
mov eax, 0x52da6c
xor ecx, ecx
mov edx, 0x7c
call fcn.00403a94
jmp 0x4d70c2
movzx eax, word [ebp - 2]
shr eax, 3
mov edx, 0x52da6c
mov ecx, 0x7c
call fcn.00467404
jmp 0x4d70c2
mov eax, 0x52da6c
xor ecx, ecx
mov edx, 0x7c
call fcn.00403a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d70e4
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040520c
ret