joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f8c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x47f8d7
add esp, 0xfffffff0
call fcn.00404178
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427840
mov eax, dword [0x6087c0]
cmp word [eax + 2], 0
jne 0x47f8ff
mov eax, dword [0x6087c0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00481040
mov eax, dword [0x608914]
cmp word [eax + 2], 0
jne 0x47f919
mov eax, dword [0x608914]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00481238
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41bbf4]
call fcn.00403de4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41bbf4]
call fcn.00403de4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x429e8c]
call fcn.00431e48
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x47faa0
mov eax, dword [0x608660]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00432218
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4817e8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x608660]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e830
test eax, eax
je 0x47fa0e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a38c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e858
test eax, eax
je 0x47fa22
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404f14
mov eax, dword [0x60840c]
cmp byte [eax], 0
jne 0x47fa56
mov eax, ebx
call fcn.0047fbc8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004819c4
mov eax, ebx
call fcn.00482388
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47fa96
call fcn.004041d0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fe48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x609c60]
cmp dword [eax + 0x30], 0
je 0x47fef2
cmp dword [ebx + 0x94], 0
jne 0x47feec
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x47fdd8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47feec
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47feb2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47feec
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e720
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47fec1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x480a54
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x480a89
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404d94
jmp 0x480a96
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404cf8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x481ba0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x481be1
mov eax, esi
call fcn.00468020
test al, al
je 0x481be1
mov eax, dword [ebx + 0x84]
call fcn.00467d1c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x481be1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00467d1c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x483c68
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405154
xor eax, eax
push ebp
push 0x483d96
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x483d69
xor eax, eax
push ebp
push 0x483d62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f64
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x483d37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x483d26
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f64
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00405164
mov edx, ebx
pop ecx
call fcn.00402ab0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483d2d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x6084c4]
mov dl, 1
mov eax, dword [0x40869c]
call fcn.0040da24
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483d9d
lea eax, [ebp - 4]
call fcn.00404ca4
ret
Function at 0x483da4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x483f55
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405354
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x483f6c
call fcn.00404fb0
mov eax, ebx
call fcn.00427e64
mov edi, eax
dec edi
test edi, edi
jl 0x483e5c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00427e38
mov edx, dword [0x452fb0]
call fcn.00403fa0
test al, al
je 0x483e58
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00427e38
lea edx, [ebp - 0x14]
call fcn.004614fc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405354
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405024
inc esi
dec edi
jne 0x483e0a
mov al, byte [0x483f70]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x483f7c
mov eax, dword [ebp - 0xc]
call fcn.0040f1d4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404d3c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004614fc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x483f6c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004614fc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x483f6c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x483f6c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x483f88
call fcn.0040aa2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483f5c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404cc8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404cc8
lea eax, [ebp - 0x14]
call fcn.00404ca4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cc8
ret
Function at 0x489b30
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403234
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x48fc88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
or ecx, 0xffffffff
dec edx
test edx, edx
jb 0x48fcb9
inc edx
xor ebx, ebx
mov esi, ecx
and esi, 0xff
mov edi, eax
add edi, ebx
movzx edi, byte [edi]
xor esi, edi
mov esi, dword [esi*4 + 0x5da514]
shr ecx, 8
xor esi, ecx
mov ecx, esi
inc ebx
dec edx
jne 0x48fc96
xor ecx, 0xffffffff
mov eax, ecx
pop edi
pop esi
pop ebx
ret

Function at 0x490384
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x609de4
mov eax, ebx
mov edx, 8
test al, 1
je 0x4903a0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4903a2
shr eax, 1
dec edx
jne 0x490393
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x49038c
pop ebx
ret

Function at 0x4903b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, ecx
dec edx
test edx, edx
jl 0x4903e2
inc edx
mov ecx, dword [eax]
xor cl, byte [esi]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x609de4]
mov ebx, dword [eax]
shr ebx, 8
xor ecx, ebx
mov dword [eax], ecx
inc esi
dec edx
jne 0x4903c4
pop esi
pop ebx
ret
Function at 0x495758
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0xc], al
mov ecx, edx
mov byte [ebp - 0xb], cl
xor eax, eax
mov al, byte [ebp - 0xc]
add eax, eax
lea eax, [eax + eax*2]
xor edx, edx
mov dl, cl
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 0xa], al
xor eax, eax
mov al, byte [ebp - 0xc]
lea eax, [eax + eax*4]
xor edx, edx
mov dl, byte [ebp - 0xb]
add edx, edx
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 9], al
xor eax, eax
mov al, byte [ebp - 0xc]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0xb]
lea edx, [edx + edx*2]
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 8], al
xor eax, eax
mov al, byte [ebp - 0xc]
lea eax, [eax + eax*2]
xor edx, edx
mov dl, byte [ebp - 0xb]
shl edx, 2
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 7], al
xor eax, eax
mov al, byte [ebp - 0xc]
add eax, eax
xor edx, edx
mov dl, byte [ebp - 0xb]
lea edx, [edx + edx*4]
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 6], al
xor eax, eax
mov al, byte [ebp - 0xc]
xor edx, edx
mov dl, byte [ebp - 0xb]
add edx, edx
lea edx, [edx + edx*2]
add eax, edx
add eax, 3
mov ecx, 7
xor edx, edx
div ecx
mov byte [ebp - 5], al
mov dword [ebp - 0x10], 0x10
mov esi, dword [ebp - 4]
add esi, 2
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0x7fffffff
xor edi, edi
lea ebx, [ebp - 0xc]
xor eax, eax
mov al, byte [ebx]
xor edx, edx
mov dl, byte [esi]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 0x14]
jge 0x495864
mov dword [ebp - 0x14], eax
mov eax, edi
mov byte [ecx], al
inc edi
inc ebx
cmp edi, 8
jne 0x495849
inc ecx
add esi, 8
dec dword [ebp - 0x10]
jne 0x49583d
mov al, byte [ebp - 0x23]
shl eax, 3
or al, byte [ebp - 0x24]
mov dl, byte [ebp - 0x22]
and dl, 3
shl edx, 6
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx], al
mov al, byte [ebp - 0x22]
and al, 4
and eax, 0xff
shr eax, 2
mov dl, byte [ebp - 0x21]
add edx, edx
or al, dl
mov dl, byte [ebp - 0x20]
shl edx, 4
or al, dl
mov dl, byte [ebp - 0x1f]
and dl, 1
shl edx, 7
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx + 1], al
mov al, byte [ebp - 0x1f]
and al, 6
and eax, 0xff
shr eax, 1
mov dl, byte [ebp - 0x1e]
shl edx, 2
or al, dl
mov dl, byte [ebp - 0x1d]
shl edx, 5
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx + 2], al
mov al, byte [ebp - 0x1b]
shl eax, 3
or al, byte [ebp - 0x1c]
mov dl, byte [ebp - 0x1a]
and dl, 3
shl edx, 6
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx + 3], al
mov al, byte [ebp - 0x1a]
and al, 4
and eax, 0xff
shr eax, 2
mov dl, byte [ebp - 0x19]
add edx, edx
or al, dl
mov dl, byte [ebp - 0x18]
shl edx, 4
or al, dl
mov dl, byte [ebp - 0x17]
and dl, 1
shl edx, 7
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx + 4], al
mov al, byte [ebp - 0x17]
and al, 6
and eax, 0xff
shr eax, 1
mov dl, byte [ebp - 0x16]
shl edx, 2
or al, dl
mov dl, byte [ebp - 0x15]
shl edx, 5
or al, dl
mov edx, dword [ebp + 8]
mov byte [edx + 5], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x495d0c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jns 0x495d27
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x495e4b
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x495d48
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x495e3f
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 4
call fcn.00403234
xor ebx, ebx
xor esi, esi
xor eax, eax
mov edx, dword [ebp - 0x14]
shl edx, 2
add edx, esi
imul edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 2
add edx, ecx
add edx, eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
mov byte [ebp + ebx - 0x3c], dl
and edx, 0xff
add dword [ebp - 0x1c], edx
inc ebx
inc eax
cmp eax, 4
jne 0x495d83
inc esi
cmp esi, 4
jne 0x495d81
mov eax, dword [ebp - 0x1c]
test eax, eax
jns 0x495dc3
add eax, 0xf
sar eax, 4
mov dword [ebp - 0x1c], eax
xor ebx, ebx
xor esi, esi
lea eax, [ebp - 0x3c]
xor edx, edx
mov dl, byte [eax]
cmp edx, dword [ebp - 0x1c]
jle 0x495dec
add dword [ebp - 0x24], edx
inc ebx
mov ecx, esi
mov dx, 1
shl dx, cl
or word [ebp - 0x16], dx
jmp 0x495def
add dword [ebp - 0x20], edx
inc esi
inc eax
cmp esi, 0x10
jne 0x495dd0
test ebx, ebx
jle 0x495e0a
mov eax, dword [ebp - 0x24]
cdq
idiv ebx
call fcn.0048ffc4
mov byte [ebp - 0x17], al
jmp 0x495e0e
mov byte [ebp - 0x17], 0
mov eax, 0x10
sub eax, ebx
push eax
mov eax, dword [ebp - 0x20]
pop edx
mov ecx, edx
cdq
idiv ecx
call fcn.0048ffc4
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
add dword [ebp - 8], 4
inc dword [ebp - 0x10]
dec dword [ebp - 0x2c]
jne 0x495d5f
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x495d3e
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a4788
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a47b5
mov eax, ebx
call fcn.004a4718
cmp byte [ebx + 0x40], 0
je 0x4a47ae
mov dword [ebx + 0x14], 0xcf
mov al, 1
pop esi
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x4a4825
mov eax, dword [ebx + 0x190]
cmp byte [eax + 0x10], 0
je 0x4a481a
mov eax, dword [ebx + 8]
test eax, eax
je 0x4a47d8
mov esi, eax
mov eax, ebx
call dword [esi]
mov esi, dword [ebx + 0x190]
mov eax, ebx
call dword [esi]
test eax, eax
jne 0x4a47eb
xor eax, eax
pop esi
pop ebx
ret
cmp eax, 2
je 0x4a481a
cmp dword [ebx + 8], 0
je 0x4a47cb
cmp eax, 3
je 0x4a47fe
dec eax
jne 0x4a47cb
mov eax, dword [ebx + 8]
inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4a47cb
mov edx, dword [ebx + 0x11c]
add dword [eax + 8], edx
jmp 0x4a47cb
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x84], eax
jmp 0x4a483a
cmp eax, 0xcc
je 0x4a483a
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.00499148
mov eax, ebx
call fcn.004a4844
pop esi
pop ebx
ret

Function at 0x4b09b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x4b09de
cmp dword [ebx + 0x64], 0
jne 0x4b09de
cmp dword [ebx + 0x6c], 0
jne 0x4b09de
mov esi, edi
jmp 0x4b0a6d
cmp esi, 0xffffffff
jne 0x4b09e9
dec esi
jmp 0x4b0a6d
mov eax, dword [ebx + 0x64]
mov edx, edi
sub edx, 0x106
add edx, edi
cmp eax, edx
jb 0x4b0a6d
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.004abf58
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x4b0a35
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x4b0a3a
mov word [edx], 0
dec eax
test eax, eax
jne 0x4b0a1b
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x4b0a61
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x4b0a66
mov word [edx], 0
dec eax
test eax, eax
jne 0x4b0a47
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4b0acb
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.004b0758
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4b0ab6
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4b0acb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4b09be
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b5bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x14
call fcn.00403234
mov dword [ebp - 0x14], 0x7fffffff
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
lea esi, [eax - 0x18]
lea ebx, [ebp - 0x28]
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi]
push eax
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004b5a1c
pop ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax - 4]
dec ecx
test ecx, ecx
jl 0x4b5c1f
inc ecx
xor edi, edi
mov eax, dword [esi]
movsx eax, byte [eax + edi]
cdq
xor eax, edx
sub eax, edx
add dword [ebx], eax
inc edi
dec ecx
jne 0x4b5c0e
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x14]
jge 0x4b5c31
mov dl, byte [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov byte [ecx], dl
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
add ebx, 4
add esi, 4
cmp dword [ebp - 0x10], 5
jne 0x4b5be6
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + eax*4 - 0x18]
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx - 4]
mov edx, dword [ebp + 8]
call fcn.00402ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dd840
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x4dd872
push ebx
call fcn.004de358
pop ecx
mov dl, byte [ebx + 0x40]
test dl, dl
je 0x4dd86b
mov dword [ebx + 0x14], 0xcf
mov al, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x4dd8e8
mov ecx, dword [ebx + 0x190]
mov al, byte [ecx + 0x10]
test al, al
je 0x4dd8dd
mov edx, dword [ebx + 8]
test edx, edx
je 0x4dd898
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x190]
call dword [eax]
pop ecx
test eax, eax
jne 0x4dd8ab
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0x4dd8dd
mov edx, dword [ebx + 8]
test edx, edx
je 0x4dd88a
cmp eax, 3
je 0x4dd8bf
dec eax
jne 0x4dd88a
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x4dd88a
mov edx, dword [ebx + 0x11c]
add dword [eax + 8], edx
jmp 0x4dd88a
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x84], eax
jmp 0x4dd908
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x4dd908
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.004dd914
pop ecx
pop ebx
pop ebp
ret

Function at 0x4dd914
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xcc
je 0x4dd99e
push ebx
mov edx, dword [ebx + 0x180]
call dword [edx]
pop ecx
xor ecx, ecx
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x14], 0xcc
jmp 0x4dd99e
mov eax, dword [ebx + 8]
test eax, eax
je 0x4dd957
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x60]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x78]
lea eax, [ebx + 0x78]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x184]
call dword [edx + 4]
add esp, 0x10
mov ecx, dword [ebx + 0x78]
cmp esi, ecx
jne 0x4dd97a
xor eax, eax
jmp 0x4dd9bd
mov edx, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x60]
cmp edx, ecx
jb 0x4dd940
push ebx
mov eax, dword [ebx + 0x180]
call dword [eax + 4]
pop ecx
push ebx
mov edx, dword [ebx + 0x180]
call dword [edx]
pop ecx
xor ecx, ecx
mov dword [ebx + 0x78], ecx
mov eax, dword [ebx + 0x180]
mov dl, byte [eax + 8]
test dl, dl
jne 0x4dd97a
mov ecx, 0xce
mov al, byte [ebx + 0x41]
test al, al
jne 0x4dd9b8
dec ecx
mov dword [ebx + 0x14], ecx
mov al, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4e9c94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x6c]
sub eax, edx
mov ecx, dword [ebx + 0x64]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x4e9cd8
mov edx, dword [ebx + 0x24]
sub edx, 0x106
add edx, esi
mov ecx, dword [ebx + 0x64]
cmp edx, ecx
ja 0x4e9d63
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.004d321c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x3c]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp esi, ecx
ja 0x4e9d2c
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4e9d2e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e9d13
mov eax, esi
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x38]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp esi, ecx
ja 0x4e9d58
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4e9d5a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e9d3f
add dword [ebp - 8], esi
mov edi, dword [ebx]
mov eax, dword [edi + 4]
test eax, eax
je 0x4e9dd0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x64]
add ecx, eax
mov edx, dword [ebx + 0x6c]
add ecx, edx
push ecx
push edi
call fcn.004e9950
add esp, 0xc
add dword [ebx + 0x6c], eax
mov ecx, dword [ebx + 0x6c]
cmp ecx, 3
jb 0x4e9db9
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
mov edx, dword [ebx + 0x4c]
and eax, edx
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 0x6c]
cmp eax, 0x106
jae 0x4e9dd0
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4e9ca3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret