joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d805
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push dword [esi + 4]
mov dword [ebp - 4], ebx
call fcn.0043e635
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x45d917
push dword [esi]
call fcn.00434fa2
pop ecx
mov word [0x5b38e4], 1
push 1
push dword [esi]
call fcn.00434fde
pop ecx
push eax
call fcn.004ac06b
pop ecx
push eax
call fcn.004876c0
mov dword [ebp - 0x10], eax
mov eax, dword [0x5b7bf4]
mov dword [ebp - 0x60], eax
pop ecx
lea eax, [ebp - 0x60]
pop ecx
mov dword [0x5b7bf4], eax
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0xc], 0x5b7bf4
mov dword [ebp - 0x5c], ebx
call fcn.0052a5c0
mov esi, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
jne 0x45d8e3
call fcn.004c096e
mov edi, eax
add edi, 0xc
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0x70]
jg 0x45d8b9
cmp word [ebp + 0x10], bx
jne 0x45d8a5
call fcn.004c096e
cmp eax, edi
jae 0x45d8b9
push dword [ebp - 8]
push dword [esi + 0x6c]
push esi
call fcn.0045d92d
add esp, 0xc
inc dword [esi + 0x6c]
jmp 0x45d88e
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0x70]
jle 0x45d8d9
mov eax, dword [0x5b38e8]
cmp eax, ebx
je 0x45d8d9
push esi
push 0x45dee5
push eax
call fcn.004c43ce
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
jmp 0x45d8e9
mov eax, dword [ebp - 0x54]
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
push dword [esi]
call fcn.00434fde
pop ecx
push eax
call fcn.004ac06b
pop ecx
push eax
call fcn.004876c0
pop ecx
mov word [0x5b38e4], bx
pop ecx
push dword [ebp - 8]
push dword [esi + 4]
call fcn.0043e67d
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x45d928
cmp dword [ebp - 4], 0x400a0013
je 0x45d928
inc dword [esi + 0x6c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47a4a2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x5b3cf8], edi
jne 0x47a4c7
or dword [0x5b3cd0], 0xffffffff
or dword [0x5b3cc4], 0xffffffff
jmp 0x47a5af
call fcn.0043f892
mov esi, eax
cmp esi, edi
jne 0x47a4e7
or dword [0x5b3cd0], 0xffffffff
or dword [0x5b3cc4], 0xffffffff
push 1
jmp 0x47a57e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.0043eeb3
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.0043f8ad
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add esp, 0xc
cmp eax, dword [0x5b3cc4]
jne 0x47a524
cmp ecx, dword [0x5b3cd0]
jne 0x47a524
push 1
pop ebx
jmp 0x47a526
xor ebx, ebx
cmp word [0x598460], di
mov dword [0x5b3cc4], eax
mov dword [0x5b3cd0], ecx
jne 0x47a5f3
mov eax, dword [0x5b3cf8]
cmp esi, eax
je 0x47a554
cmp esi, dword [0x5b3cf0]
je 0x47a554
push 1
push eax
jmp 0x47a584
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.0043eeb3
add esp, 0xc
push 0x5b3cd8
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00442194
add esp, 0xc
test ax, ax
jne 0x47a58d
push edi
push dword [0x5b3cf8]
call fcn.0047a45a
pop ecx
pop ecx
jmp 0x47a5f3
cmp word [0x5b3d00], di
jne 0x47a5f3
mov ax, word [0x5b3ce8]
cmp ax, di
jne 0x47a5d8
cmp word [0x5b3cec], di
je 0x47a5b6
cmp bx, di
jne 0x47a5b6
call fcn.0047a38c
jmp 0x47a5f3
cmp ax, di
jne 0x47a5d8
call fcn.004c096e
mov esi, eax
sub esi, dword [0x5b3cfc]
call fcn.0043bee1
cmp esi, eax
sbb eax, eax
neg eax
cmp ax, di
jne 0x47a5f3
mov ax, word [0x5b3cc0]
push eax
push dword [0x5b3ccc]
push dword [0x5b3cc8]
call fcn.0047a5f8
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x488fd1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
push edi
mov esi, 0x598b30
lea edi, [ebp - 0x58]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x54], 0x43
movsx eax, byte [ebp - 0x54]
test eax, eax
je 0x489122
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x489108
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
mov dword [ebp - 0x5c], 0x50
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x489108
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x489052
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
jmp 0x48903e
push 0x598b2c
push dword [ebp - 0x70]
call fcn.0048446e
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
push 0x3a
push dword [ebp - 0x70]
call fcn.00484452
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x6c], 0
je 0x489081
mov eax, dword [ebp - 0x6c]
and byte [eax], 0
jmp 0x48908d
cmp dword [ebp - 0x64], 0
je 0x48908d
mov eax, dword [ebp - 0x64]
and byte [eax], 0
push dword [ebp - 0x70]
call fcn.00489128
pop ecx
push dword [ebp - 0x70]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0048446e
pop ecx
pop ecx
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x489108
mov eax, dword [ebp + 8]
inc eax
cmp dword [ebp - 0x68], eax
jne 0x489108
push dword [ebp + 8]
call fcn.004843e8
pop ecx
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x489108
mov eax, dword [ebp + 8]
mov byte [eax], 0x2f
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x54]
mov byte [eax + 1], cl
mov eax, dword [ebp + 8]
and byte [eax + 2], 0
push dword [ebp - 0x70]
call fcn.0048427f
pop ecx
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + eax + 1]
push eax
push dword [ebp + 8]
call fcn.0048448f
pop ecx
pop ecx
push dword [ebp - 0x74]
call fcn.00486983
pop ecx
push 1
pop eax
jmp 0x489124
mov al, byte [ebp - 0x54]
add al, 1
mov byte [ebp - 0x54], al
movsx eax, byte [ebp - 0x54]
cmp eax, 0x5a
jle 0x48911d
and byte [ebp - 0x54], 0
jmp 0x488fe8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4891ed
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 8], 0
je 0x4892c1
and dword [ebp - 0x28], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.00416369
pop ecx
pop ecx
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x12c]
mov dword [ebp - 0xc], eax
push 0x598b28
lea eax, [ebp - 0x12c]
push eax
call fcn.00484294
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call fcn.0048427f
pop ecx
lea eax, [ebp + eax - 0x12c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x489296
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x2f
jne 0x489272
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jne 0x489272
jmp 0x489296
lea eax, [ebp - 0x29]
cmp dword [ebp - 0x24], eax
jne 0x48927c
jmp 0x489296
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
mov byte [eax], cl
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
jmp 0x489252
mov eax, dword [ebp - 0x24]
and byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.004892c5
pop ecx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x4892c1
push 1
pop eax
jmp 0x4892c3
xor eax, eax
leave
ret
Function at 0x48930c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], 0x640
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.0052ba30
pop ecx
mov byte [ebp - 0x14], al
movsx eax, byte [ebp - 0x14]
cmp eax, 0x41
jl 0x489344
movsx eax, byte [ebp - 0x14]
cmp eax, 0x5a
jle 0x48934b
xor eax, eax
jmp 0x48949e
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x489363
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 2]
cmp eax, 0x5c
je 0x48936a
xor eax, eax
jmp 0x48949e
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48938b
xor eax, eax
jmp 0x48949e
push dword [ebp - 0x1c]
call fcn.00529a10
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4893a2
jmp 0x489484
push 1
pop eax
test eax, eax
je 0x489484
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call sub.MPR.dll_WNetEnumResourceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x489401
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00529ac0
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4893f9
jmp 0x489484
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
jmp 0x4893a2
cmp dword [ebp - 0xc], 0
je 0x489409
jmp 0x489484
and dword [ebp - 0x24], 0
jmp 0x489416
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jge 0x48947f
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + eax + 0x10], 0
je 0x48947d
movsx esi, byte [ebp - 0x14]
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax + 0x10]
movsx eax, byte [eax]
push eax
call fcn.0052ba30
pop ecx
cmp esi, eax
jne 0x48947d
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
push dword [ecx + eax + 0x14]
push dword [ebp + 8]
call fcn.00529920
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
inc eax
push eax
push dword [ebp + 8]
call fcn.00529930
pop ecx
pop ecx
jmp 0x489484
jmp 0x48940f
jmp 0x4893a2
push dword [ebp - 0x18]
call sub.MPR.dll_WNetCloseEnum
cmp dword [ebp - 0x10], 0
je 0x48949b
push dword [ebp - 0x10]
call fcn.00529d90
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x489e79
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x489f0b
test byte [ebp + 0xc], 4
je 0x489e97
mov eax, 0xc0000000
xor ecx, ecx
push 2
jmp 0x489eca
test byte [ebp + 0xc], 2
je 0x489eba
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x489eb1
mov eax, 0x400a0010
pop ebp
ret
mov eax, 0xc0000000
xor ecx, ecx
jmp 0x489ec8
push 1
pop ecx
cmp word [ebp + 0xc], cx
jne 0x489ecd
mov eax, Ordinal_3
push 3
pop edx
jmp 0x489ed6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
push 0
push 0x10000080
push edx
push 0
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x489f02
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x400d0000
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov eax, 0x400a0001
pop ebp
ret
Function at 0x48a17d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push esi
lea eax, [ebp - 0x140]
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x48a2e4
lea eax, [ebp - 0x340]
and byte [ebp + 8], 0
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0052b790
add esp, 0x14
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
lea eax, [ebp + 8]
push 1
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00529920
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x59320c
push eax
call fcn.00529930
pop ecx
lea eax, [ebp - 0xb8]
pop ecx
mov dword [ebp - 0xb8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x48a2e4
cmp dword [ebp - 0xa8], 1
jne 0x48a286
mov eax, dword [ebp - 0xac]
and eax, 0xffff
cmp eax, 0x3e8
ja 0x48a286
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x48a2e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x48a2d7
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x48a2e4
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a2dd
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
call eax
test eax, eax
je 0x48a2dd
cmp dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
jbe 0x48a2cb
or dword [eax], 0xffffffff
jmp 0x48a2d0
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, 1
jmp 0x48a2e7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ax, ax
pop esi
leave
ret
Function at 0x4a5880
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edx, edx
push 1
cmp word [0x5b4290], dx
pop ecx
jne 0x4a58f6
lea esi, [eax + 0x10]
mov dword [ebp + 8], ecx
mov edi, esi
mov ecx, edx
shl ecx, 8
or ecx, edx
shl ecx, 2
mov ebx, ecx
shl ebx, 0x10
or ebx, ecx
add ebx, 0x3020100
inc edx
mov dword [edi], ebx
add edi, 4
cmp edx, 0x10
jl 0x4a589f
xor ecx, ecx
mov dl, byte [esi + ecx]
movzx edi, dl
sub edi, ecx
mov byte [ecx + 0x5b4298], dl
neg edi
sbb edi, edi
inc edi
and dword [ebp + 8], edi
inc ecx
cmp ecx, 0x40
jl 0x4a58c3
mov cx, word [ebp + 8]
push 1
mov word [0x5b42d8], cx
pop ecx
mov word [0x5b4290], cx
xor edx, edx
cmp byte [ebp + 0xc], dl
je 0x4a5904
cmp word [0x5b42d8], dx
jne 0x4a5906
xor ecx, ecx
pop edi
pop esi
mov byte [eax + 0x58], cl
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
pop ebp
ret
Function at 0x4ce40a
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 3
jne 0x4ce449
lea eax, [esi + 0x28]
push edi
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.004ce320
add esp, 0xc
test ax, ax
jne 0x4ce434
mov dword [esi + 0xc], 2
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push dword [esi + 0x1c]
call edi
push 2
push dword [esi + 0x20]
call edi
pop edi
pop esi
ret

Function at 0x4ce62b
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004f75c9
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
and dword [0x5b77b0], 0
pop ebp
mov ebx, str.acroct.ini
mov edi, str.WinFntSvr
push ebx
push ebp
push str.FontResPublic
push edi
mov dword [0x5b4518], eax
mov dword [0x5b77a8], ebp
mov dword [0x5b77ac], ebp
call esi
push ebx
push 0
push str.T1ToTTDisabled
push edi
mov dword [0x5b77a8], eax
call esi
push ebx
push ebp
push str.TTToSysDisabled
push edi
mov dword [0x5b77b0], eax
call esi
push 0
push 0x4e30e7
push 0
push 0x3b
mov dword [0x5b77ac], eax
call fcn.00484bff
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4e1e7a
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, dword [0x5b45e4]
test eax, eax
je 0x4e1e9f
push 0
push 0x4e2021
push eax
call fcn.004a62e7
add esp, 0xc
push dword [0x5b45e4]
call fcn.004a632e
pop ecx
mov eax, dword [0x5b45e8]
and dword [0x5b45e4], 0
test eax, eax
je 0x4e1eb6
push eax
call fcn.004a632e
pop ecx
and dword [0x5b45e8], 0
call fcn.004e215a
test ax, ax
je 0x4e1ecc
jmp fcn.004e1ecd
ret
Function at 0x4eccec
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], eax
call fcn.004ece64
cmp word [ebp + 0xc], 0xffff
pop ecx
jne 0x4ecd32
push 0x15
add edi, 0x28
pop ebx
lea eax, [ebp - 8]
push eax
push 0x4ecd90
push dword [edi]
call fcn.004a62e7
add esp, 0xc
add edi, 4
dec ebx
jne 0x4ecd17
jmp 0x4ecd88
cmp word [ebp + 0xc], 0xcc
jne 0x4ecd5c
lea eax, [ebp - 8]
push eax
push 0x4ecd90
push dword [edi + 0x3c]
call fcn.004a62e7
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x4ecd90
push dword [edi + 0x48]
jmp 0x4ecd80
call fcn.0049e2ec
push edx
push eax
push dword [ebp + 0xc]
call fcn.004eb7a1
add esp, 0xc
cmp eax, 0x14
je 0x4ecd88
lea ecx, [ebp - 8]
push ecx
push 0x4ecd90
push dword [edi + eax*4 + 0x28]
call fcn.004a62e7
add esp, 0xc
pop edi
mov ax, 1
pop ebx
leave
ret
Function at 0x4fae31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ax, word [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
neg ax
push esi
mov esi, dword [ecx]
mov ecx, dword [ebp + 0xc]
push edi
sbb eax, eax
mov dl, byte [ecx]
and al, 1
add eax, 0xff
mov byte [ebp - 1], dl
mov byte [ebp + 0x1b], al
mov byte [ecx], 0xaa
movzx ecx, byte [ebx]
movzx edx, al
xor ecx, edx
inc ebx
test ecx, ecx
mov dword [ebp - 8], ecx
jne 0x4faed9
cmp byte [ebx], al
jne 0x4faed3
cmp byte [ebx + 1], al
lea ecx, [ebx + 1]
jne 0x4faecb
cmp byte [ebx + 2], al
lea ecx, [ebx + 2]
jne 0x4faec5
cmp byte [ebx + 3], al
lea ecx, [ebx + 3]
jne 0x4faebf
mov cl, al
push 4
neg cl
sbb ecx, ecx
pop edx
mov dword [ebp + 8], ecx
mov ecx, ebx
and ecx, 3
lea edi, [ebx - 1]
sub edx, ecx
mov ecx, dword [ebp + 8]
add ebx, edx
cmp dword [ebx], ecx
jne 0x4faeaf
add ebx, 4
jmp 0x4faea6
imul edi, edi, 0x1fff
add edi, ebx
shl edi, 3
add word [esi], di
jmp 0x4fae5f
add word [esi], 0x20
jmp 0x4faecf
add word [esi], 0x18
jmp 0x4faecf
add word [esi], 0x10
mov ebx, ecx
jmp 0x4fae5f
add word [esi], 8
jmp 0x4fae5f
mov dx, word [ecx*2 + 0x57ad28]
lea ecx, [ecx*2 + 0x57ad28]
movzx edi, dx
mov cl, byte [ecx + 2]
mov dword [ebp + 8], edx
add edi, 0x57af30
sub cl, byte [ebp + 8]
mov byte [ebp + 0xb], cl
jne 0x4faf07
call fcn.004ce6e9
mov al, byte [ebp + 0x1b]
cmp byte [ebp + 0xb], 8
jbe 0x4faf15
call fcn.004ce6e9
mov al, byte [ebp + 0x1b]
cmp esi, dword [ebp + 0x14]
jb 0x4faf22
call fcn.004ce6e9
mov al, byte [ebp + 0x1b]
movzx edx, byte [ebp + 0xb]
lea ecx, [edx - 1]
cmp ecx, 7
ja case.default.0x4faf32
jmp dword [ecx*4 + 0x4faff8]
cmp dword [ebp + 0xc], ebx
jb 0x4fafe6
movzx cx, byte [edi + 6]
mov word [esi + 0xe], cx
movzx cx, byte [edi + 5]
mov word [esi + 0xc], cx
movzx cx, byte [edi + 4]
mov word [esi + 0xa], cx
movzx cx, byte [edi + 3]
mov word [esi + 8], cx
movzx cx, byte [edi + 2]
mov word [esi + 6], cx
movzx cx, byte [edi + 1]
mov word [esi + 4], cx
not al
mov byte [ebp + 0x1b], al
jmp case.default.0x4faf32
cmp dword [ebp + 0xc], ebx
jb 0x4fafe6
movzx cx, byte [edi + 7]
mov word [esi + 0x10], cx
movzx cx, byte [edi + 6]
mov word [esi + 0xe], cx
movzx cx, byte [edi + 5]
mov word [esi + 0xc], cx
movzx cx, byte [edi + 4]
mov word [esi + 0xa], cx
movzx cx, byte [edi + 3]
mov word [esi + 8], cx
movzx cx, byte [edi + 2]
mov word [esi + 6], cx
movzx cx, byte [edi + 1]
mov word [esi + 4], cx
movzx cx, byte [edi]
mov word [esi + 2], cx
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + 0x57b330]
and cl, 0xf
movzx cx, cl
add word [esi], cx
lea esi, [esi + edx*2]
jmp 0x4fae5f
mov ecx, dword [ebp + 0xc]
mov al, byte [ebp - 1]
pop edi
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop ebx
leave
ret
Function at 0x4fc4e3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp + 0x10], ebx
jle 0x4fc567
mov eax, dword [ebp + 8]
push 0x108
push eax
mov ecx, dword [eax]
call dword [ecx]
pop ecx
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x4fc567
push edi
push esi
xor esi, esi
xor eax, eax
mov byte [ecx + eax + 4], al
inc eax
cmp eax, 0x100
jl 0x4fc50c
xor edi, edi
mov edx, dword [ebp + 0xc]
mov al, byte [ecx + edi + 4]
mov dl, byte [esi + edx]
add edx, ebx
add edx, eax
and edx, 0xff
mov dword [ebp - 4], edx
mov dl, byte [ecx + edx + 4]
mov ebx, dword [ebp - 4]
mov byte [ecx + edi + 4], dl
mov byte [ecx + ebx + 4], al
lea eax, [esi + 1]
cdq
idiv dword [ebp + 0x10]
inc edi
cmp edi, 0x100
mov esi, edx
jl 0x4fc51a
mov eax, dword [ebp + 8]
and byte [ecx + 0x104], 0
and byte [ecx + 0x105], 0
pop esi
mov dword [ecx], eax
pop edi
mov eax, ecx
pop ebx
leave
ret

Function at 0x4fc56c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4fc5f1
mov al, byte [ecx + 0x104]
push esi
mov esi, dword [ebp + 0x14]
mov byte [ebp + 0xb], al
mov al, byte [ecx + 0x105]
test esi, esi
mov byte [ebp - 1], al
jle 0x4fc5de
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
sub eax, edx
push edi
push ebx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], esi
inc byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
lea esi, [eax + ecx + 4]
mov al, byte [eax + ecx + 4]
add byte [ebp - 1], al
movzx edi, byte [ebp - 1]
mov bl, byte [edi + ecx + 4]
lea edi, [edi + ecx + 4]
mov byte [esi], bl
mov esi, dword [ebp + 0x10]
mov byte [edi], al
add eax, ebx
and eax, 0xff
mov al, byte [eax + ecx + 4]
xor al, byte [esi + edx]
mov byte [edx], al
inc edx
dec dword [ebp + 0x14]
jne 0x4fc5a1
pop ebx
pop edi
mov al, byte [ebp + 0xb]
pop esi
mov byte [ecx + 0x104], al
mov al, byte [ebp - 1]
mov byte [ecx + 0x105], al
leave
ret
Function at 0x511419
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov edx, dword [esi + 0x6c]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x64]
sub eax, edx
sub eax, ecx
mov dword [ebp + 8], eax
jne 0x511443
test ecx, ecx
jne 0x511443
test edx, edx
jne 0x511443
mov eax, edi
jmp 0x5114b9
cmp eax, 0xffffffff
jne 0x51144d
push 0xfffffffffffffffe
pop eax
jmp 0x5114b9
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x5114b9
mov eax, dword [esi + 0x30]
push edi
lea ecx, [edi + eax]
push ecx
push eax
call fcn.0050b9c9
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x51147e
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x51149d
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x511514
push eax
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x6c]
push eax
push ecx
call fcn.00511519
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x511500
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x64]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x511514
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x511425
pop edi
pop esi
pop ebx
pop ebp
ret