joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ee5
Capabilities:
Encode data using base64

Disassembly:
push 0x64
mov eax, 0xd9f419
call fcn.00d1ef12
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
xor ebx, ebx
mov dword [ebp - 0x70], edi
push 0x41
push ebx
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x6c], ebx
call fcn.00d712b0
add esp, 0xc
mov ecx, ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x54], al
inc ecx
cmp ecx, 0x1a
jl 0x406f10
mov ecx, ebx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x3a], al
inc ecx
cmp ecx, 0x1a
jl 0x406f1f
mov ecx, ebx
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x406f2e
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov word [ebp - 0x16], 0x2f2b
mov byte [edi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], 1
test eax, eax
je 0x407091
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
inc ecx
mov byte [ebp + edi - 0x58], al
inc edi
mov dl, byte [ebp - 0x57]
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x56]
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x5f], ch
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], cl
cmp edi, esi
jne 0x406fec
mov esi, dword [ebp - 0x64]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x5c], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x5b], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], ch
movzx eax, byte [ebp + edi - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.004070f8
inc edi
cmp edi, 4
jl 0x406fc6
mov dl, byte [ebp - 0x5d]
mov edi, ebx
mov cl, byte [ebp - 0x5e]
mov ch, byte [ebp - 0x5f]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x406f69
mov dword [ebp - 0x68], edi
test edi, edi
je 0x407091
mov eax, edi
cmp edi, esi
jge 0x407022
cmp eax, esi
jae 0x40709c
mov byte [ebp + eax - 0x58], bl
inc eax
cmp eax, esi
jl 0x40700a
mov ch, byte [ebp - 0x56]
mov dl, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x5c], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x5b], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x59], ch
lea eax, [edi + 1]
mov byte [ebp - 0x5a], dl
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x40707c
mov esi, dword [ebp - 0x64]
mov edi, eax
movzx eax, byte [ebp + ebx - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.004070f8
inc ebx
cmp ebx, edi
jl 0x40705f
mov edi, dword [ebp - 0x68]
push 3
pop esi
cmp edi, esi
jge 0x407091
sub esi, edi
mov ecx, dword [ebp - 0x64]
push 0x3d
call fcn.004070f8
sub esi, 1
jne 0x407082
mov eax, dword [ebp - 0x64]
call fcn.00d1eed0
ret 0xc
call fcn.00d1edd3
int3
Function at 0x4070a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dh, byte [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
test dh, 1
je 0x4070e4
mov al, byte [ebp + 8]
test esi, esi
je 0x4070e2
mov edi, esi
mov dh, al
mov dl, dh
add dl, dl
mov al, dl
xor al, 0x1b
test dh, dh
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov dh, cl
sub edi, 1
jne 0x4070c0
mov byte [ebp - 1], dh
mov al, cl
mov dh, byte [ebp + 0xc]
xor bl, al
shr dh, 1
inc esi
mov byte [ebp + 0xc], dh
cmp esi, 8
jl 0x4070b0
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8
Function at 0x4a9063
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
xor ecx, ecx
push ecx
push ecx
mov eax, dword [ebx + 0x18]
push 3
push ecx
push 3
push ecx
push edx
call eax
mov edi, eax
cmp edi, esi
je 0x4a90bb
mov eax, dword [ebx + 8]
lea ecx, [ebp - 8]
xor edx, edx
push edx
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push edx
push edx
push 0x2d1080
push edi
call eax
test eax, eax
push edi
cmovne esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00d1eeae
leave
ret 4

Function at 0x4abf6e
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0xd9fb2b
call fcn.00d1eedf
mov esi, ecx
push 0x2f
push 0x5c
lea eax, [ebp - 0x10]
mov dword [esi + 4], 1
xor ebx, ebx
lea ecx, [ebp + 8]
push eax
mov dword [ebp - 4], ebx
mov dword [esi], ebx
call fcn.004b77c1
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [ebp + 8], ecx
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
push eax
call fcn.004b7121
pop ecx
lea eax, [ebp + 8]
push eax
push str.Global_
lea eax, [ebp - 0x10]
push eax
call fcn.004ad7fb
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004b918b
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
mov byte [ebp - 4], bl
push eax
call fcn.004b7121
mov eax, dword [esi]
pop ecx
test eax, eax
jne 0x4ac02e
lea eax, [ebp + 8]
push eax
push str.Local_
lea eax, [ebp - 0x10]
push eax
call fcn.004ad7fb
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004b918b
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
push eax
call fcn.004b7121
mov eax, dword [esi]
pop ecx
test eax, eax
je 0x4ac075
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ac075
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4ac05e
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ac075
cmp eax, 0x80
je 0x4ac075
cmp dword [esi], 0
je 0x4ac075
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
push ecx
call fcn.004b7121
pop ecx
mov eax, esi
call fcn.00d1eebc
ret 8
Function at 0x4b02eb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp byte [eax], 0
mov dword [ebp - 8], eax
je 0x4b03bd
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 8]
call fcn.004b298d
mov ecx, eax
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x4b031d
mov ecx, eax
jmp 0x4b0357
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x4b032a
sub ecx, 0x47
jmp 0x4b0357
lea eax, [ecx - 0x30]
cmp eax, 9
ja 0x4b0337
add ecx, 4
jmp 0x4b0357
cmp ecx, 0x2b
jne 0x4b0340
push 0x3e
jmp 0x4b0347
cmp ecx, 0x2f
jne 0x4b034a
push 0x3f
pop ecx
jmp 0x4b0357
cmp ecx, 0x3d
jne 0x4b03c4
push 0x40
pop ecx
cmp esi, 1
jle 0x4b03c4
mov byte [ebp + esi - 4], cl
inc esi
cmp esi, 4
jl 0x4b0307
mov cl, byte [ebp - 3]
mov al, byte [ebp - 4]
mov edx, dword [edi]
shr cl, 4
shl al, 2
or cl, al
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov bl, byte [ebp - 2]
cmp bl, 0x40
jae 0x4b03b1
mov al, byte [ebp - 3]
mov cl, bl
mov edx, dword [edi]
shr cl, 2
shl al, 4
or cl, al
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov al, byte [ebp - 1]
cmp al, 0x40
jae 0x4b03b1
mov edx, dword [edi]
mov ecx, edi
shl bl, 6
or bl, al
movzx eax, bl
push eax
call dword [edx + 0x14]
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x4b0305
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
xor al, al
jmp 0x4b03bf
Function at 0x4b0a3d
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 4
push esi
push 0x4b8ff1
push dword [esi + 0x130]
push 0
call fcn.00d7aa0d
add esp, 0x18
lea edi, [esi + 0xc]
xchg dword [edi], eax
mov eax, dword [edi]
nop
test eax, eax
je 0x4b0ab3
mov ecx, dword [ebp - 8]
lea eax, [esi + 0x10]
xchg dword [eax], ecx
mov ecx, dword [edi]
nop
push dword [ebp + 8]
mov al, byte [esi + 0x50]
push ecx
push eax
call fcn.004b871e
add esp, 0xc
test al, al
je 0x4b0aa5
mov eax, dword [edi]
nop
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x4b0ab5
mov ecx, esi
call fcn.004b50f7
mov ecx, esi
call fcn.004afbd5
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00d1eeae
leave
ret 4

Function at 0x4b2159
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
movq xmm0, qword [esi]
movq qword [ebp - 8], xmm0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
nop
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push dword [ebp + 0x10]
xor edx, dword [ebp + 0xc]
mov ecx, esi
xor eax, dword [ebp + 8]
push edx
push eax
lea eax, [ebp - 8]
push eax
call fcn.004afcf8
mov edx, dword [ebp - 4]
test al, al
mov eax, dword [ebp - 8]
je 0x4b2177
pop esi
leave
ret 0xc
Function at 0x4b219c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov ecx, dword [edi + 0x74]
mov dword [ebp - 0xc], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, ecx
mov dword [ebp - 8], esi
cmp dword [edi + 0x6c], eax
jb 0x4b2245
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00d70d30
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
mov esi, ecx
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
movzx ecx, bx
movzx eax, word [edi]
mov edx, eax
mov dword [ebp - 4], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x4b21f3
mov edi, dword [ebp + 8]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, dword [ebp - 4]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x4b2220
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4b2302
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 8], edx
cmovbe esi, eax
test esi, esi
je 0x4b22bb
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4b2286
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004ba34b
jmp 0x4b229f
cmp eax, 2
jne 0x4b22a5
cmp dword [ebx], 0
jne 0x4b2294
xor eax, eax
jmp 0x4b22a2
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004b04ac
add esp, 0xc
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push dword [ebp - 8]
call fcn.00d70d30
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
add ecx, esi
mov dword [ebp - 8], ecx
mov dword [edi + 0x74], ecx
cmp ecx, 3
jb 0x4b22ea
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [ebp - 8]
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp ecx, 0x106
jae 0x4b2302
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4b2302
mov ebx, dword [ebp - 0xc]
jmp 0x4b21b1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4b2a1a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd9fd98
mov eax, dword fs:[0]
push eax
mov eax, dword [0xe14344]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.004b918b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret
Function at 0x4b2def
Capabilities:
Get common file path

Disassembly:
push 0x410
mov eax, 0xda0432
call fcn.00d1ef12
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x41c], esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x418]
push eax
push 0x204
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.004aac93
and dword [ebp - 4], 0
lea eax, [ebp - 0x41c]
push eax
push esi
call fcn.004b5aed
mov ecx, dword [ebp - 0x41c]
add ecx, 0xfffffff8
push ecx
call fcn.004b7121
add esp, 0x14
mov eax, esi
call fcn.00d1eed0
ret

Function at 0x4b50f7
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [ecx + 0xc]
nop
test eax, eax
je 0x4b510c
mov eax, dword [ecx + 0xc]
nop
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret

Function at 0x4b5a1a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004b918b
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.004b918b
push 0xa
xor ecx, ecx
push ecx
push esi
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop esi
seta al
pop ebp
ret 8

Function at 0x4b6ae5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4b6b3d
and dword [ebp - 8], 0
lea ecx, [ebp - 8]
push 0
push ecx
push dword [ebp + 0xc]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b6b38
lea eax, [ebp - 0xc]
push eax
call fcn.004b3814
pop ecx
mov ecx, dword [esi + 0x18]
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov dword [eax], ecx
lea ecx, [ebp - 0xc]
call fcn.004ace26
mov eax, dword [ebp - 8]
jmp 0x4b6b3f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00d1eeae
leave
ret 8

Function at 0x4ba19a
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0xda08e0
call fcn.00d1eedf
push 0xdb26c0
push ecx
mov ecx, esp
push dword [ebp + 8]
call fcn.004ac1a5
lea eax, [ebp + 8]
push eax
call fcn.004ad8df
and dword [ebp - 4], 0
mov ecx, eax
call fcn.004b918b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
call fcn.004b7121
pop ecx
call fcn.00d1eebc
ret 4
push ebp
mov ebp, esp
mov ecx, dword [0xe1ca38]
test ecx, ecx
je 0x4ba1ad
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 4]
pop ebp
jmp 0x4b5a9b

Function at 0x4ba58c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4ba599
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004b04ac
Function at 0x4bf353
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xdad49c
push 0xdad498
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004bdbd8
mov ecx, dword [eax]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ecx
call fcn.004bdc4d
add esp, 0x14
mov ecx, esi
push dword [ebp - 8]
call fcn.004ac269
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00d1eeae
leave
ret 4
Function at 0x4de17e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [eax + 0x10]
mov esi, 0xff00ff
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, 0x100
mov edi, eax
and eax, 0xff00ff
shr edi, 8
and edi, esi
mov ecx, edi
shr ecx, 0x10
sub edx, ecx
mov ecx, dword [ebx]
mov esi, ecx
shr ecx, 8
and esi, 0xff00ff
imul esi, edx
shr esi, 8
and esi, 0xff00ff
add esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
mov edx, 0x100
shr ecx, 8
and ecx, eax
add edi, ecx
mov ecx, esi
mov eax, edi
shr ecx, 8
shr eax, 8
and ecx, 0xff00ff
and eax, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0x10]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov dword [ebp + 0x10], eax
test eax, eax
jg 0x4de195
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4e3220
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x100
mov edx, dword [ebx + 0x4c]
cmp edx, 1
mov edi, dword [ebx + 0x1a8]
sete al
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], edx
mov byte [edi + 0x1c], al
mov eax, dword [ebx + 4]
push dword [ebx + 0x64]
mov ecx, dword [eax + 8]
mov eax, 0x2fe
cmovne eax, esi
push eax
push 1
push ebx
call ecx
xor esi, esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x14]
add esp, 0x10
mov dword [ebp - 0x10], esi
cmp dword [ebx + 0x64], esi
jle 0x4e3344
mov ecx, dword [edi + esi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 8], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jne 0x4e3294
mov eax, dword [edi + 0x18]
add dword [eax + esi*4], 0xff
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax + esi*4]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
lea eax, [esi + 0xfe]
lea ebx, [esi*2 - 2]
cdq
idiv ebx
mov dword [ebp - 0x18], ebx
xor edi, edi
mov edx, eax
cmp edi, edx
jle 0x4e32e4
imul eax, ecx, 0x1fe
lea ebx, [esi + 0xfe]
add ebx, eax
add ebx, 0x1fe
inc ecx
mov eax, ebx
cdq
idiv dword [ebp - 0x18]
mov edx, eax
cmp edi, edx
jg 0x4e32ce
mov dword [ebp - 4], ecx
movzx eax, cl
mov ecx, dword [ebp - 0x14]
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 0xc]
mov byte [edi + eax], cl
inc edi
mov ecx, dword [ebp - 4]
cmp edi, 0xff
jle 0x4e32bc
cmp dword [ebp - 8], 1
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
jne 0x4e3331
mov edi, eax
xor ecx, ecx
inc ecx
lea edx, [edi - 1]
mov al, byte [edi]
mov byte [edx], al
mov al, byte [edi + 0xff]
mov byte [edi + ecx + 0xff], al
inc ecx
dec edx
cmp ecx, 0xff
jle 0x4e3316
mov edi, dword [ebp - 0x1c]
inc esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
cmp esi, dword [ebx + 0x64]
jl 0x4e3277
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4efd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x30]
mov edx, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0x10]
mov esi, 0xff00ff
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
imul ebx, edx
push edi
mov dword [ebp - 8], ecx
add ebx, dword [ecx + 0x34]
cmp dword [ebp + 0x10], 0xff
jge 0x4efe4f
mov dword [ebp + 0xc], eax
push edx
lea eax, [ebp - 0xc]
inc edx
push eax
mov dword [ebp + 8], edx
call fcn.004ed60e
mov ecx, 0x100
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [ebp + 0x10]
and edi, esi
imul edi, dword [ebp + 0x10]
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and esi, 0xff00ff
imul esi, ecx
shr esi, 8
and esi, 0xff00ff
add esi, edx
mov edx, 0xff00ff
and eax, edx
imul eax, ecx
mov ecx, esi
shr ecx, 8
and ecx, 0xff00ff
shr eax, 8
and eax, edx
add edi, eax
mov eax, edi
shr eax, 8
and eax, edx
mov edx, 0x100
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov edx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x4efd78
jmp 0x4eff0e
mov dword [ebp + 0x10], eax
push edx
lea eax, [ebp + 0xc]
inc edx
push eax
mov dword [ebp + 8], edx
call fcn.004ed60e
mov ecx, 0x100
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
and edi, esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and esi, 0xff00ff
imul esi, ecx
shr esi, 8
and esi, 0xff00ff
add esi, edx
mov edx, 0xff00ff
and eax, edx
imul eax, ecx
mov ecx, esi
shr ecx, 8
and ecx, 0xff00ff
shr eax, 8
and eax, edx
add edi, eax
mov eax, edi
shr eax, 8
and eax, edx
mov edx, 0x100
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0x10]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov edx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
test eax, eax
jg 0x4efe52
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4eff15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x30]
mov edx, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0x10]
mov esi, 0xff00ff
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
imul ebx, edx
push edi
mov dword [ebp - 8], ecx
add ebx, dword [ecx + 0x34]
cmp dword [ebp + 0x10], 0xff
jge 0x4f0024
mov dword [ebp + 0xc], eax
push edx
lea eax, [ebp - 0xc]
inc edx
push eax
mov dword [ebp + 8], edx
call fcn.004ed64d
mov ecx, 0x100
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [ebp + 0x10]
and edi, esi
imul edi, dword [ebp + 0x10]
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and esi, 0xff00ff
imul esi, ecx
shr esi, 8
and esi, 0xff00ff
add esi, edx
mov edx, 0xff00ff
and eax, edx
imul eax, ecx
mov ecx, esi
shr ecx, 8
and ecx, 0xff00ff
shr eax, 8
and eax, edx
add edi, eax
mov eax, edi
shr eax, 8
and eax, edx
mov edx, 0x100
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov edx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x4eff4d
jmp 0x4f00e3
mov dword [ebp + 0x10], eax
push edx
lea eax, [ebp + 0xc]
inc edx
push eax
mov dword [ebp + 8], edx
call fcn.004ed64d
mov ecx, 0x100
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
and edi, esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and esi, 0xff00ff
imul esi, ecx
shr esi, 8
and esi, 0xff00ff
add esi, edx
mov edx, 0xff00ff
and eax, edx
imul eax, ecx
mov ecx, esi
shr ecx, 8
and ecx, 0xff00ff
shr eax, 8
and eax, edx
add edi, eax
mov eax, edi
shr eax, 8
and eax, edx
mov edx, 0x100
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0x10]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov edx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
test eax, eax
jg 0x4f0027
pop edi
pop esi
pop ebx
leave
ret 0xc