joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e900
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x44e92d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x58c420]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x44e910
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x44e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x44e9e1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5c08c0]
test eax, eax
je 0x44e9ec
call eax
lea eax, [esi*8]
push eax
call fcn.0044a3f0
mov ecx, dword [0x5c08c4]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x44ea0d
call ecx
test esi, esi
je 0x44e9d8
push dword [ebx + 0xc]
call fcn.0044a740
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x5ba5f0]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.005392b0
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x44eaf0
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x44ea7f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x58c420]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x44ea62
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x44eaca
mov eax, dword [esi]
test eax, eax
je 0x44ea9d
mov edx, dword [esi + 4]
jmp 0x44ea9f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x44eaca
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x44eabf
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x44eae6
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x44eae6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x44eadc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x44ea56
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ec10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x44ec64
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x44ec54
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x58c420]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x44ec34
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x44ec66
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.0044eb00
add esp, 8
test eax, eax
je 0x44ec80
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x44ec90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x44ece5
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x44ecd5
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x58c420]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x44ecb5
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x44ecea
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.0044eb00
add esp, 8
test eax, eax
je 0x44ed32
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x44ed22
push ebx
mov edx, eax
mov ecx, esi
call fcn.0044ebb0
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x44edd0
push 0x14
call fcn.0044a3f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x44ed56
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x44ed96
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x44ed96
add edx, edx
mov ecx, esi
call fcn.0044e9b0
test eax, eax
je 0x44ed96
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0044e900
xor edx, edx
div dword [esi]
jmp 0x44ed99
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44edb7
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.0044e940
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x44edc6
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x48445d
cmp byte [edx], al
je 0x484455
inc ebx
cmp byte [ebx], al
jne 0x484450
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x4844ff
mov ecx, edi
cmp edi, 2
jge 0x484477
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x48447a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4844ce
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x4844b0
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58c420]
cmp cl, byte [edx + 0x58c420]
jne 0x4844b0
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484493
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x58c420]
movzx eax, byte [eax + 0x58c420]
sub eax, ecx
jne 0x4844ef
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0044ec10
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x4844ff
jmp 0x4844f2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x484468
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x48464d
cmp byte [edx], al
je 0x484645
jmp 0x484640
inc ebx
cmp byte [ebx], al
jne 0x484640
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x4846f3
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x48466d
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4846cb
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x4846b0
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58c420]
cmp cl, byte [edx + 0x58c420]
jne 0x4846ad
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484690
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x58c420]
movzx ecx, byte [ecx + 0x58c420]
sub eax, ecx
jne 0x4846e0
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.0044ec10
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x4846f3
jmp 0x4846e3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x484663
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, edx
mov dword [esp + 0x1c], esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
test esi, esi
je 0x484c5d
test edi, edi
je 0x484a9d
cmp dword [edi + 0x200], 0
jne 0x484aac
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x484c5d
mov ebx, dword [esi + 8]
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x484bff
jmp 0x484ac0
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x18], esi
test edi, edi
je 0x484ad8
cmp dword [edi + 0x200], 0
jne 0x484b9f
mov esi, dword [ebx]
mov ecx, esi
mov dword [esp + 0x30], esi
test esi, esi
je 0x484afe
cmp byte [esi], 0
je 0x484af6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x484af0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x18]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov edx, dword [eax]
mov dword [esp + 0x34], edx
test edx, edx
je 0x484b71
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
test ecx, ecx
jle 0x484b65
mov ebx, ecx
mov edi, eax
mov ecx, esi
lea ebx, [ebx]
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x58c420]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x484b30
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
xor edx, edx
div dword [esp + 0x34]
mov eax, dword [esp + 0x14]
jmp 0x484b73
xor edx, edx
push edx
mov dword [esp + 0x14], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0044eb00
add esp, 8
test eax, eax
je 0x484b9b
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.0044ebb0
add esp, 4
mov esi, dword [esp + 0x18]
test edi, edi
je 0x484bac
cmp dword [edi + 0x200], 0
jne 0x484bc0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x484bc0
dec dword [eax]
jne 0x484bc0
push eax
call fcn.0044a740
add esp, 4
mov edx, dword [ebx + 0x24]
mov ecx, edi
call fcn.0047b670
mov edx, dword [ebx + 0x10]
mov ecx, edi
call fcn.0044a7e0
test byte [ebx + 0x38], 0x10
je 0x484be4
mov edx, dword [ebx + 0x20]
mov ecx, edi
call fcn.0044a7e0
mov edx, ebx
mov ecx, edi
call fcn.0044a7e0
mov dword [esp + 0x1c], esi
mov ebx, esi
test esi, esi
jne 0x484ac0
mov esi, dword [esp + 0x20]
mov edx, esi
mov ecx, edi
call fcn.00491990
mov edx, esi
mov ecx, edi
call fcn.004849f0
mov edx, dword [esi]
mov ecx, edi
call fcn.0044a7e0
mov edx, dword [esi + 0x14]
mov ecx, edi
call fcn.0044a7e0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x484c3d
mov edx, esi
mov ecx, edi
call fcn.0049adc0
mov edx, esi
mov ecx, edi
call fcn.0044a7e0
mov esi, dword [esp + 0x20]
mov ecx, edi
mov edx, dword [esi + 0x18]
call fcn.0047c380
mov edx, esi
mov ecx, edi
call fcn.004ab300
mov edx, esi
mov ecx, edi
call fcn.0044a7e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0044c650
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x4870e6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x4870e0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x487221
mov edi, ebx
cmp ebx, 2
jge 0x487111
xor edi, 1
test esi, esi
je 0x48716f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x48714d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58c420]
cmp cl, byte [edx + 0x58c420]
jne 0x48714d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x487130
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x58c420]
movzx ecx, byte [ecx + 0x58c420]
sub eax, ecx
jne 0x4871e3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x4871bb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x4871b0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x58c420]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x487190
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x4871bd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.0044eb00
add esp, 8
test eax, eax
je 0x4871dc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x487200
jmp 0x4871e6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4871e6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x487107
test eax, eax
je 0x487221
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.00484330
add esp, 0x18
jmp 0x487224
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 4
jle 0x4870b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x4bdba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4bdbc0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4bdbe9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4bdbe6
inc esi
cmp esi, edx
jb 0x4bdbd7
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4bdcf1
cmp ecx, 3
jbe 0x4bdc02
xor eax, eax
jmp 0x4bdc40
dec ecx
shl eax, cl
and eax, 7
je 0x4bdc40
movzx ecx, byte [eax + 0x58f70c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x58f704], 0
mov cl, byte [edx + 4]
je 0x4bdc2a
test cl, cl
je 0x4bdc2a
cmp cl, 0xff
jne 0x4bdc3d
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4bdbd0
mov edx, dword [ebp - 8]
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x4bdc62
cmp cl, 0xff
je 0x4bdc62
mov ecx, dword [ebp - 4]
and eax, 3
add eax, eax
or eax, 1
inc edi
jmp 0x4bdbd0
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4bdcbe
movzx edx, byte [eax + 0x58f70c]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4bdcaa
cmp dl, 0xff
jne 0x4bdcbe
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4bdc80
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
add edi, 5
mov byte [esi + 2], cl
mov ecx, dword [ebp - 4]
jmp 0x4bdbd0
pop esi
pop ebx
cmp ecx, 3
jbe 0x4bdd06
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4bff1f
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4bff42
or esi, 1
push 1
call edi
test ax, ax
jns 0x4bff4e
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4bff5a
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4bff66
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c0b0b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xd0]
call fcn.004bf132
mov edi, dword [ebp + 8]
test eax, eax
jle 0x4c0b5b
push ebx
mov byte [ebp + 0xb], 0
call fcn.004bf155
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4c0bb6
lea ecx, [esi + 0xd0]
inc ebx
call fcn.004bf132
cmp ebx, eax
jl 0x4c0b2a
sub edi, 0x100
je 0x4c0c10
sub edi, 4
je 0x4c0bba
dec edi
dec edi
jne 0x4c0c05
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.005448ae
pop ecx
mov ecx, dword [esi + 0x50]
lea edx, [ebp + 8]
push 0x8000000a
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x4c3cc3
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4c0c05
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4c0c07
cmp dword [esi + 0x54], 0
je 0x4c0c05
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004bff1f
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4c0c05
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x4c0c5d
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.00539bcf
pop ecx
pop ecx
test eax, eax
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
call fcn.004d402f
test al, al
jne 0x4c0c05
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.004c2845
jmp 0x4c0bb6
Function at 0x4c9022
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x5718e8
call fcn.0054512b
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.004c925a
call fcn.004c05ae
push eax
lea ecx, [ebp - 0x9c]
call fcn.004bf2ce
and dword [ebp - 4], 0
call fcn.004c05b4
mov edx, eax
mov ecx, eax
call fcn.004bf41b
lea ecx, [ebp - 0x9c]
test al, al
je 0x4c913c
push ebx
call fcn.004bf666
xor ebx, ebx
lea ecx, [ebp - 0x9c]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
call fcn.004bf30c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d8], eax
push ebx
cmp eax, 0xffffffff
jne 0x4c90ac
push 0x59bef4
jmp 0x4c9211
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x4c90bf
push ebx
jmp 0x4c91ad
cmp edi, 0x400000
jbe 0x4c90cd
push ebx
jmp 0x4c91be
push edi
mov dword [ebp - 0x2d0], ebx
call fcn.0051d4c8
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2d0]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d8]
mov dword [ebp - 0x2d4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], edi
je 0x4c9127
push ebx
call fcn.00538881
pop ecx
mov ecx, esi
call fcn.004c925a
push 0
push str.Could_not_read_file
jmp 0x4c9211
push ecx
push edi
push ebx
mov ecx, esi
call fcn.004c8f8f
push dword [ebp - 0x2d4]
jmp 0x4c923d
push edx
call fcn.004bf649
call fcn.004c05ba
test al, al
je 0x4c9152
call fcn.004c05c0
jmp 0x4c9169
push 2
lea ecx, [ebp - 0x9c]
call fcn.004bf443
xor edx, edx
mov ecx, eax
call fcn.004d2d81
pop ecx
mov edi, eax
test edi, edi
jne 0x4c917a
push eax
push str.Error_opening_zip_file
jmp 0x4c9211
lea eax, [ebp - 0x2cc]
mov edx, ebx
push eax
lea eax, [ebp - 0x2d4]
push eax
push ecx
mov ecx, edi
call fcn.004d2f0f
add esp, 0xc
test eax, eax
je 0x4c91a2
push 0
push str.Could_not_find_ziped_file
jmp 0x4c9211
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
jne 0x4c91b4
push ebx
push str.File_is_empty
jmp 0x4c9211
cmp ebx, 0x400000
jbe 0x4c91c5
push 0
push str.File_too_large
jmp 0x4c9211
push ebx
call fcn.0051d4c8
mov edx, dword [ebp - 0x2d4]
mov ecx, edi
push ebx
push eax
mov dword [ebp - 0x2d0], eax
call fcn.004d2fe3
add esp, 0xc
test eax, eax
je 0x4c921c
cmp eax, 0x600
je 0x4c921c
push dword [ebp - 0x2d0]
call fcn.00538881
pop ecx
call fcn.004c05ba
test al, al
jne 0x4c920a
mov ecx, edi
call fcn.004d3016
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.004c997e
mov bl, al
jmp 0x4c9245
call fcn.004c05ba
test al, al
jne 0x4c922c
mov ecx, edi
call fcn.004d3016
mov edi, dword [ebp - 0x2d0]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.004c8f8f
push edi
mov bl, al
call fcn.00538881
pop ecx
lea ecx, [ebp - 0x9c]
call fcn.004bf2f3
mov al, bl
call fcn.005450da
ret 8
Function at 0x4d0ea1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4d0eac
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4d0f64
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
dec edi
jne 0x4d0ec7
pop edi
test esi, esi
je 0x4d0f7d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x590840]
inc edx
dec esi
jne 0x4d0f68
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4d176d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x4d17a7
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d17a2
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x4d17ce
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4d17b7
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00538be0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret