joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449424
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x449444
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00447af8
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x449467
test byte [esp + 8], 2
je 0x449467
call fcn.00447b6b
mov dword [eax], 0xd
call fcn.00447b74
mov dword [eax], 5
jmp 0x449440
xor eax, eax
ret

Function at 0x451c44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x519070
cmp edx, dword [eax]
je 0x451c66
add eax, 8
inc ecx
cmp eax, 0x519100
jl 0x451c57
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x519070]
jne 0x451d94
mov eax, dword [0x52e46c]
cmp eax, 1
je 0x451d6e
test eax, eax
jne 0x451c97
cmp dword [0x5166e4], 1
je 0x451d6e
cmp edx, 0xfc
je 0x451d94
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x451cce
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00447da0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004469c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x451d11
lea eax, [ebp - 0x1a4]
push eax
call fcn.004469c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4f6514
push edi
call fcn.00447c70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00447da0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00447db0
lea eax, [ebp - 0xa0]
push 0x4f64f4
push eax
call fcn.00447db0
push dword [esi + 0x519074]
lea eax, [ebp - 0xa0]
push eax
call fcn.00447db0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00457676
add esp, 0x2c
pop edi
jmp 0x451d94
lea eax, [ebp + 8]
lea esi, [esi + 0x519074]
push 0
push eax
push dword [esi]
call fcn.004469c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x46bf00
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x566f60]
test eax, eax
jne 0x46bf36
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
mov esi, eax
push esi
push 0x566f60
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp dword [0x566f60], esi
je 0x46bf35
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [0x566f60]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x46c060
Capabilities:
Get disk information
Query environment variable

Disassembly:
sub esp, 0x100
push 0x100
push 0
push 0x64f400
call fcn.0048e830
add esp, 0xc
push 0xfe
lea eax, [esp + 4]
push eax
push str.SystemDrive
mov dword [0x566f18], 0
mov byte [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x46c0a9
cmp eax, 0xfe
jbe 0x46c0ba
lea ecx, [esp]
push 0x51b774
push ecx
call fcn.0047de70
add esp, 8
lea edx, [esp]
push edx
call fcn.0048e8f0
add esp, 4
test eax, eax
je 0x46c0da
cmp byte [esp + eax - 1], 0x5c
je 0x46c0da
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
push 0
push 0
push 0
push 0
push 0x64f400
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x46c104
mov dword [0x566f18], 4
add esp, 0x100
ret

Function at 0x46c740
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x51b880]
test eax, eax
je 0x46c76f
mov dword [0x566f9c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x51b764], eax
je 0x46c779
mov dword [0x51b880], 0
jmp 0x46c774
mov eax, dword [0x51b764]
cmp eax, 0xffffffff
jne 0x46c77c
xor eax, eax
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x46c7be
push 4
call fcn.0046e5b0
mov esi, eax
add esp, 4
test esi, esi
je 0x46c7ba
mov eax, dword [0x51b764]
push esi
push eax
mov dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46c7be
push esi
call fcn.0046e5d0
add esp, 4
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x46f660
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00497150
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x46f6f0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x51b890]
and eax, 0xff00
cmp eax, 0x5000
je 0x46f73d
shr edi, 2
xor edx, edx
test edi, edi
jle 0x46f73d
push ebx
mov edi, edi
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x46f710
pop ebx
pop edi
ret
Function at 0x473070
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 0
push ebp
push edi
je 0x47308c
pop edi
mov dword [esp + 0xc], 0xdd
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 2]
xor ecx, ecx
mov ch, byte [eax]
push esi
mov cl, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
cmp ecx, 0x54534421
jne 0x4730d3
movzx esi, byte [eax + 6]
xor edx, edx
mov dh, byte [eax + 4]
mov ecx, 1
mov dl, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
or edx, esi
jmp 0x4730f3
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 0x54534421
je 0x4730f0
pop esi
pop edi
mov dword [esp + 0xc], 0xd8
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov edx, dword [eax + 4]
cmp edx, 2
je 0x473109
pop esi
pop edi
mov dword [esp + 0xc], 0xdf
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
cmp ecx, 1
jne 0x47312a
movzx edx, byte [eax + 0x16]
xor ecx, ecx
mov ch, byte [eax + 0x14]
mov cl, byte [eax + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x17]
shl ecx, 8
or ecx, edx
jmp 0x47312d
mov ecx, dword [eax + 0x14]
add ecx, 0x20
push ecx
push eax
call fcn.00498860
mov esi, eax
add esp, 8
test esi, esi
je 0x4731d5
push ebx
push esi
call fcn.00498060
mov edi, eax
push esi
mov dword [esp + 0x20], edi
call fcn.00498800
add esp, 0xc
test edi, edi
jne 0x4731dd
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
xor ebp, ebp
test ecx, ecx
jbe 0x4731dd
xor ebx, ebx
jmp 0x473170
mov esi, dword [eax + 0x14]
mov ecx, dword [esi + ebx]
mov edx, dword [eax + 0x18]
add esi, ebx
lea eax, [edx + ecx*8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
push edx
call fcn.004987a0
mov edi, eax
add esp, 8
test edi, edi
je 0x4731c6
push edi
call fcn.00472b90
push edi
mov dword [esi + 0xc], eax
call fcn.00498460
mov eax, dword [esi + 0xc]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
je 0x4731e6
mov eax, dword [eax]
mov ecx, dword [eax + 8]
inc ebp
add ebx, 0x10
cmp ebp, ecx
jb 0x473170
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push edx
call fcn.00472a70
add esp, 4
mov dword [esp + 0x14], 0xc
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [eax]
push ecx
call fcn.00472a70
add esp, 4
pop esi
pop edi
mov dword [esp + 0xc], 0x7d1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
Function at 0x478a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
jmp 0x478e47
push edi
mov edi, ecx
cmp eax, 0x14c33
je 0x478e6c
cmp eax, 0
je 0x478e8a
cmp eax, 0
je 0x478ea8
cmp eax, 0
je 0x478ec6
add byte [eax + 0x5f], dh
pop edi
jmp 0x47aace
mov eax, 0xd38d20b7
stosd dword es:[edi], eax
mov eax, 0x44e6c27c
stosd dword es:[edi], eax
mov eax, 0xf497dac2
stosd dword es:[edi], eax
mov eax, 0xf9b70d
stosd dword es:[edi], eax
pop edi
jmp 0x47aafc
jb 0x478ea4
add byte [eax], al
adc eax, 0x2fdd5d14
jp 0x478ef3
adc eax, 0x5ca563b
xor eax, 0x42fc5d9f
adc dword [edx - 0x4de64edf], esi
jge 0x478ef0
jno 0x478ecf
sub dh, byte [ecx - 0x44]
jno 0x478e63
and dword [edx + 0x48da735a], esi
mov dl, 0x5a
jae 0x478e86
dec eax
pop ecx
xor dword [ecx + 0x67ebb231], esi
xor eax, 0x3f90241e
push ebx
xor eax, 0x603c5822
mov esi, ecx
or eax, 0x58b9211a
or eax, 0x723872e8
pop eax
push eax
xor dword [ebx + 0x49d17553], esi
push ebx
jne 0x478ea3
dec ecx
adc eax, 0x388f268d
xor ecx, 0x6ef66fe6
sbb dword [ebx + 0x55bd57d], esi
sub eax, 0x7a43d726
movsb byte es:[edi], byte [esi]
push ebx
adc dword [ebx - 0x4ccec08c], esi
and eax, 0x1b4d4997
inc ecx
inc edx
mov bl, 0x74
aas
xor dword [ebx + 0x4d499725], esi
mov bl, 0x25
xchg edi, eax
dec ecx
dec ebp
sbb eax, dword [ecx + 0x42]
push eax
jno 0x478eec
int3
mov eax, 0xfffffffe
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x47e0c0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47e0e1
ret
mov eax, dword [esp + 0xc]
ret
Function at 0x47f4b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add dword [eax + 4], edx
mov edx, dword [ecx + 4]
add esi, edx
mov dword [eax], esi
lea edx, [ecx + 0x10]
mov dword [esp + 0x10], 3
mov edi, edi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ebp
mov esi, ebx
mov edi, ebp
shr edi, 4
and edi, 0x1f
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 8]
shl ebx, cl
mov ecx, 0x20
or esi, ebx
sub esi, edi
mov dword [eax + 4], esi
mov edi, esi
shr edi, 7
xor esi, ebp
and edi, 0x1f
sub ecx, edi
mov ebx, esi
shr ebx, cl
mov ecx, edi
shl esi, cl
mov ecx, dword [edx - 4]
or ebx, esi
add ecx, ebx
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
xor ebx, esi
mov edi, esi
mov dword [eax + 4], esi
shr edi, 7
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 4]
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
mov edi, ecx
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx + 8]
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
shr edi, 7
and edi, 0x1f
mov dword [eax + 4], esi
xor ebx, esi
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 0xc]
add edx, 0x20
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx - 0x10]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
xor ebx, esi
shr edi, 7
mov dword [eax + 4], esi
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 0xc]
shl ebx, cl
mov ecx, dword [esp + 0x10]
or esi, ebx
add esi, edi
dec ecx
mov dword [eax], esi
mov dword [esp + 0x10], ecx
jne 0x47f4d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x47f610
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, 0xc
jmp 0x47f620
mov ebx, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + ebp*8 + 4]
mov edx, dword [edi]
sub edx, ecx
mov esi, ebx
shr esi, 7
and esi, 0x1f
mov eax, edx
mov ecx, 0x20
sub ecx, esi
shl eax, cl
mov ecx, esi
shr edx, cl
mov ecx, dword [esp + 0x10]
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov edx, dword [ecx + ebp*8]
lea esi, [edx + ebx]
mov edx, eax
shr edx, 4
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
mov ebx, esi
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
dec ebp
mov dword [edi + 4], ebx
jne 0x47f620
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
sub dword [edi], ecx
mov edx, dword [eax]
mov eax, ebx
pop esi
sub eax, edx
pop ebp
mov dword [edi + 4], eax
pop ebx
ret
Function at 0x48a530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 4], ebx
jle 0x48a5c0
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
nop
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x48a561
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
movzx eax, byte [edi + ebp]
lea ecx, [edi + ebp]
add eax, ebx
and eax, 0x800000ff
jns 0x48a57b
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
lea eax, [ebx + ebp]
call fcn.0048a520
movzx ecx, byte [ecx]
movzx edx, byte [eax]
add ecx, edx
and ecx, 0x800000ff
jns 0x48a59e
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, cl
mov cl, byte [eax + ebp]
mov eax, dword [esp + 0x18]
xor byte [esi + eax], cl
mov eax, dword [esp + 0x10]
inc eax
movsx esi, ax
mov dword [esp + 0x10], eax
cmp esi, dword [esp + 0x1c]
jl 0x48a550
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x48a5d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor eax, eax
mov ecx, ebx
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x48a5e0
xor dl, dl
xor esi, esi
mov ecx, ebx
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx edi, dl
movzx eax, byte [edi + eax]
movzx edx, byte [ecx]
sub eax, edx
add eax, esi
and eax, 0x800000ff
jns 0x48a615
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [esi + ebx]
call fcn.0048a520
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x18]
inc ecx
dec ebp
jne 0x48a5f5
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x48af50
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x48afa8
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x51cc00]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x51cc00]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x51cc00]
xor ax, word [edx*4 + 0x51cc00]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x48af61
pop esi
pop ebx
pop edi
ret
Function at 0x48eb60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
push eax
call fcn.004b0740
add esp, 4
test eax, eax
jne 0x48ec7f
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x48ec84
cmp ecx, 0x80
jg 0x48ec84
push edi
mov edi, dword [esp + 0x28]
xor edx, edx
mov eax, edi
div ecx
test edx, edx
je 0x48ebad
pop edi
mov eax, 0x16
pop esi
add esp, 0x14
ret
test cl, 3
jne 0x48eba2
mov ecx, dword [esi]
imul ecx, ecx, 0x58
mov ecx, dword [ecx + 0x60aed8]
test ecx, ecx
je 0x48ebe2
lea edx, [esi + 0x88]
push edx
mov edx, dword [esp + 0x24]
add esi, 8
push esi
push eax
mov eax, dword [esp + 0x30]
push eax
push edx
call ecx
add esp, 0x14
pop edi
pop esi
add esp, 0x14
ret
test edi, edi
push ebx
push ebp
je 0x48ec7a
mov ebp, dword [esp + 0x28]
mov ecx, dword [esi]
imul ecx, ecx, 0x58
lea eax, [esi + 0x88]
push eax
lea edx, [esp + 0x18]
push edx
push ebp
call dword [ecx + 0x60aec0]
add esp, 0xc
test eax, eax
jne 0x48ec7c
mov eax, dword [esi + 4]
test eax, eax
jle 0x48ec5b
mov ebx, dword [esp + 0x2c]
lea edi, [esp + 0x14]
mov edx, 0xfffffff8
sub edi, ebp
sub ebx, ebp
sub edx, esi
lea ecx, [esi + 8]
mov eax, ebp
mov dword [esp + 0x10], edx
mov ebp, dword [ecx]
mov edx, dword [edi + eax]
xor edx, ebp
mov ebp, dword [eax]
mov dword [ecx], ebp
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
mov ebp, dword [esi + 4]
add ecx, 4
add edx, ecx
add eax, 4
cmp edx, ebp
jl 0x48ec32
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
add ebp, eax
add ecx, eax
sub edi, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edi
jne 0x48ebf0
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
mov eax, 0x16
pop esi
add esp, 0x14
ret
Function at 0x49d0c0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push 0
lea eax, [esp + 0xc]
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x49d0df
pop esi
xor eax, eax
pop ebx
pop ecx
ret
inc esi
mov eax, esi
call fcn.0049cfd0
test eax, eax
mov dword [esp + 8], eax
je 0x49d0d9
push esi
push eax
push edi
call ebx
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
pop ecx
ret

Function at 0x49d1d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
mov ax, word [esp + 8]
shr ax, 0xf
lea edx, [ecx + ecx]
push ebx
push esi
mov esi, 0x16
or eax, edx
mov ecx, eax
mov dword [esp + 0x10], eax
shr ecx, 8
xor cl, al
mov byte [esp + 0x11], cl
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [esp + 0x10]
shr cx, 1
shl eax, 0xf
xor edx, edx
or eax, ecx
mov dword [esp + 0x10], eax
mov dx, word [esp + 0x10]
shr dx, 1
shl eax, 0xf
or eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
add eax, 4
jmp 0x49d230
mov dl, byte [esp + 0x10]
mov cl, dl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax - 4], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov byte [esp + 0xc], bl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax - 2], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov byte [esp + 0xc], bl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0xc], bl
mov byte [esp + 0x10], cl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shr bl, 1
shl dl, 7
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov byte [esp + 0xc], bl
mov dword [esp + 0x10], ecx
mov dx, cx
xor word [eax + 2], dx
add ecx, 0x55
add eax, 8
dec esi
mov dword [esp + 0x10], ecx
jne 0x49d230
pop esi
pop ebx
ret
Function at 0x49def0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov al, byte [esp + 8]
mov edx, dword [esp + 0xc]
and al, 0xf
push ebx
movzx cx, al
push ebp
push esi
mov word [esp + 0xc], cx
lea ebp, [edx + edi - 1]
jmp 0x49df10
xor dl, dl
test di, di
mov ecx, ebp
je 0x49df3b
movzx esi, di
lea esp, [esp]
mov al, byte [ecx]
mov bl, dl
mov dl, al
shl al, 1
or al, bl
shr dl, 7
mov byte [ecx], al
dec ecx
dec esi
jne 0x49df20
test dl, dl
je 0x49df3b
or byte [ebp], 1
mov eax, dword [esp + 0xc]
mov cx, ax
add eax, 0xffff
test cx, cx
mov dword [esp + 0xc], eax
jne 0x49df10
xor ecx, ecx
test edi, edi
jbe 0x49df70
mov esi, dword [esp + 0x18]
mov dl, byte [esp + 0x14]
xor eax, eax
mov bl, byte [eax + esi]
xor bl, dl
inc ecx
mov byte [eax + esi], bl
movzx eax, cx
cmp eax, edi
jb 0x49df60
pop esi
pop ebp
xor ax, ax
pop ebx
pop ecx
ret

Function at 0x49df80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor ecx, ecx
test ebx, ebx
push edi
jbe 0x49df9b
xor eax, eax
nop
xor byte [eax + ebp], dl
inc ecx
movzx eax, cx
cmp eax, ebx
jb 0x49df90
and dl, 0xf
movzx ax, dl
mov word [esp + 0x10], ax
xor dl, dl
test bx, bx
mov esi, ebp
je 0x49dfd1
movzx edi, bx
mov al, byte [esi]
mov cl, dl
mov dl, al
shr al, 1
shl cl, 7
or al, cl
and dl, 1
mov byte [esi], al
inc esi
dec edi
jne 0x49dfb3
test dl, dl
je 0x49dfd1
or byte [ebp], 0x80
mov eax, dword [esp + 0x10]
mov cx, ax
add eax, 0xffff
test cx, cx
mov dword [esp + 0x10], eax
jne 0x49dfa7
pop edi
pop esi
xor ax, ax
pop ebp
ret

Function at 0x49e070
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
movzx eax, byte [esi + 2]
movzx ecx, byte [eax + str._.C]
push edi
mov edi, dword [esp + 0x10]
mov eax, 4
cmp edi, eax
jle 0x49e0ad
push ebx
nop
mov bl, byte [eax + esi]
mov edx, ecx
and edx, 0xff
mov dl, byte [edx + str._.C]
xor bl, dl
inc ecx
mov byte [eax + esi], bl
inc eax
cmp eax, edi
jl 0x49e090
pop ebx
pop edi
pop esi
ret

Function at 0x49e110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
test cx, cx
push ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], eax
jbe 0x49e1b2
push ebp
movzx ecx, cx
push esi
push edi
mov dword [esp + 0x1c], ecx
jmp 0x49e140
mov eax, dword [esp + 0x10]
jmp 0x49e140
mov edi, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x18], 0x10
lea ecx, [ecx]
xor ecx, ecx
mov cl, bl
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
and ecx, 0xf
call fcn.0049e0b0
mov edx, dword [esp + 0x14]
mov esi, ebp
xor esi, edx
mov ecx, 2
lea edx, [esp + 0x24]
xor esi, ebx
call fcn.0049e0e0
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
dec eax
mov ebp, edi
mov edi, esi
mov dword [esp + 0x18], eax
jne 0x49e150
mov eax, dword [esp + 0x10]
mov dword [eax + 4], esi
mov dword [eax], ebp
add eax, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
inc ebx
dec eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
jne 0x49e131
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret