joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6ea8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x4c6ec8
mov ecx, esi
call fcn.004c6fac
test al, al
je 0x4c6f33
mov eax, dword [ebp + 0xc]
mov esi, eax
sar esi, 3
xor esi, eax
sar eax, 3
and esi, 0x7fff
xor esi, eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
or eax, esi
test al, 3
jne 0x4c6f00
mov eax, dword [edi]
mov ecx, edi
push 0
push esi
call dword [eax + 8]
push dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x14]
jmp 0x4c6f32
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x4c6f32
sub esi, ebx
mov edx, dword [edi]
lea eax, [esi + ebx]
push 0
xor eax, 3
mov ecx, edi
push eax
call dword [edx + 8]
mov edx, dword [edi]
mov eax, ebx
push 1
xor eax, 3
mov ecx, edi
push eax
call dword [edx + 0x14]
inc ebx
sub dword [ebp + 0x10], 1
jne 0x4c6f0c
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4c6f39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x4c6fa7
push edi
lea edi, [esi + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x4c6f5e
mov ecx, esi
call fcn.004c6fac
test al, al
je 0x4c6fa6
mov eax, dword [ebp + 0xc]
mov esi, eax
sar esi, 3
xor esi, eax
sar eax, 3
and esi, 0x7fff
xor esi, eax
cmp dword [ebp + 0x10], 0
jbe 0x4c6fa6
push ebx
mov ebx, dword [ebp + 8]
sub esi, ebx
mov edx, dword [edi]
lea eax, [esi + ebx]
push 0
xor eax, 3
mov ecx, edi
push eax
call dword [edx + 8]
mov edx, dword [edi]
mov eax, ebx
push 1
xor eax, 3
mov ecx, edi
push eax
call dword [edx + 0x18]
inc ebx
sub dword [ebp + 0x10], 1
jne 0x4c6f7f
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4c80d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x40072780
push esi
cmp dword [edx], eax
ja 0x4c813f
je 0x4c8104
cmp dword [edx], 0
je 0x4c8104
cmp dword [edx], 0x7408027
je 0x4c815f
cmp dword [edx], 0x12408037
je 0x4c815f
cmp dword [edx], 0x16d348e8
jne 0x4c813c
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x4c813c
mov cl, byte [esi + edx + 3]
xor byte [esi + edx], cl
mov al, byte [esi + edx]
xor al, cl
mov cl, byte [esi + edx + 2]
xor byte [esi + edx], al
xor byte [esi + edx + 1], cl
mov byte [esi + edx + 3], al
mov al, byte [esi + edx + 1]
xor al, cl
xor byte [esi + edx + 1], al
mov byte [esi + edx + 2], al
add esi, 4
cmp esi, dword [ebp + 0xc]
jl 0x4c810b
pop esi
pop ebp
ret
cmp dword [edx], 0x40123780
je 0x4c8104
cmp dword [edx], 0x56ee6322
je 0x4c8104
cmp dword [edx], 0xd316e848
je 0x4c815f
cmp dword [edx], 0xee562263
jne 0x4c813c
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x4c813c
mov cl, byte [esi + edx + 2]
xor byte [esi + edx], cl
mov al, byte [esi + edx]
xor al, cl
mov cl, byte [esi + edx + 3]
xor byte [esi + edx], al
xor byte [esi + edx + 1], cl
mov byte [esi + edx + 2], al
mov al, byte [esi + edx + 1]
xor al, cl
xor byte [esi + edx + 1], al
mov byte [esi + edx + 3], al
add esi, 4
cmp esi, dword [ebp + 0xc]
jl 0x4c8166
jmp 0x4c813c
Function at 0x4cad27
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x566023
call fcn.00514868
mov edx, ecx
sub esp, 0x18
mov eax, dword [edx + 0x10]
push esi
cmp dword [eax], 0x12408037
je 0x4cadfa
cmp dword [eax], 0x40072780
je 0x4cada6
cmp dword [eax], 0x40123780
je 0x4cada6
cmp dword [eax], 0x80371240
je 0x4cae48
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x24]
push 0x5e5dd4
push eax
call fcn.00490eb7
add esp, 0xc
mov edx, eax
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edx + 0x14], 0x10
jb 0x4cad86
mov edx, dword [edx]
mov ecx, dword [0x65c678]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.00401fa5
jmp 0x4cae48
xor esi, esi
cmp dword [edx + 0x18], esi
jbe 0x4cae48
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 3]
xor byte [esi + ecx], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx]
xor byte [esi + ecx + 3], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 3]
xor byte [esi + ecx], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 2]
xor byte [esi + ecx + 1], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 1]
xor byte [esi + ecx + 2], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 2]
xor byte [esi + ecx + 1], al
add esi, 4
cmp esi, dword [edx + 0x18]
jb 0x4cadb1
jmp 0x4cae48
xor esi, esi
cmp dword [edx + 0x18], esi
jbe 0x4cae48
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 2]
xor byte [esi + ecx], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx]
xor byte [esi + ecx + 2], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 2]
xor byte [esi + ecx], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 3]
xor byte [esi + ecx + 1], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 1]
xor byte [esi + ecx + 3], al
mov ecx, dword [edx + 0x10]
mov al, byte [esi + ecx + 3]
xor byte [esi + ecx + 1], al
add esi, 4
cmp esi, dword [edx + 0x18]
jb 0x4cae01
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4cb095
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ebp + 0xc], bl
je 0x4cb0d7
mov esi, ebx
mov cl, byte [esi + edx + 3]
xor byte [esi + edx], cl
mov al, byte [esi + edx]
xor al, cl
mov cl, byte [esi + edx + 2]
xor byte [esi + edx], al
xor byte [esi + edx + 1], cl
mov byte [esi + edx + 3], al
mov al, byte [esi + edx + 1]
xor al, cl
xor byte [esi + edx + 1], al
mov byte [esi + edx + 2], al
add esi, 4
cmp esi, 0x14
jl 0x4cb0a6
push 0x13
pop eax
mov cl, byte [eax + edx]
cmp cl, 0x20
jne 0x4cb0e7
mov byte [eax + edx], bl
jmp 0x4cb0ee
test cl, cl
je 0x4cb0ee
or eax, 0xffffffff
sub eax, 1
jns 0x4cb0da
mov ecx, edx
mov byte [edx + 0x14], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cb0fb
sub ecx, esi
test ecx, ecx
jle 0x4cb12e
mov al, byte [ebx + edx]
cmp al, 0x2f
je 0x4cb117
cmp al, 0x3a
je 0x4cb132
cmp al, 0x5c
jne 0x4cb11b
mov byte [ebx + edx], 0x2d
mov ecx, edx
inc ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cb121
sub ecx, esi
cmp ebx, ecx
jl 0x4cb108
pop esi
pop ebx
pop ebp
ret
mov byte [ebx + edx], 0x3b
jmp 0x4cb11b
Function at 0x4ce420
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x566023
call fcn.00514868
sub esp, 0x18
mov edx, ecx
mov ecx, dword [edx + 0x24]
push esi
mov esi, dword [edx + 0xc]
mov eax, dword [ecx + esi + 8]
cmp eax, 0xa141e28
je 0x4ce4eb
cmp eax, 0xc182430
je 0x4ce4eb
cmp eax, 0x281e140a
je 0x4ce49d
cmp eax, 0x3024180c
je 0x4ce49d
push ecx
push eax
lea eax, [ebp - 0x24]
push 0x5e6544
push eax
call fcn.00490eb7
add esp, 0x10
mov edx, eax
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edx + 0x14], 0x10
jb 0x4ce480
mov edx, dword [edx]
mov ecx, dword [0x65c678]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.00401fa5
jmp 0x4ce4eb
xor esi, esi
cmp dword [edx + 0x1c], esi
jbe 0x4ce4eb
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi + 3]
xor byte [ecx + esi], al
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi]
xor byte [ecx + esi + 3], al
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi + 3]
xor byte [ecx + esi], al
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi + 2]
xor byte [ecx + esi + 1], al
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi + 1]
xor byte [ecx + esi + 2], al
mov ecx, dword [edx + 0xc]
mov al, byte [ecx + esi + 2]
xor byte [ecx + esi + 1], al
add esi, 4
cmp esi, dword [edx + 0x1c]
jb 0x4ce4a4
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4ce683
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor edx, edx
cmp dword [esi + 0x1c], edx
jbe 0x4ce6d4
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx + 3]
xor byte [edx + ecx], al
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx]
xor byte [edx + ecx + 3], al
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx + 3]
xor byte [edx + ecx], al
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx + 2]
xor byte [edx + ecx + 1], al
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx + 1]
xor byte [edx + ecx + 2], al
mov ecx, dword [esi + 0xc]
mov al, byte [edx + ecx + 2]
xor byte [edx + ecx + 1], al
add edx, 4
cmp edx, dword [esi + 0x1c]
jb 0x4ce68d
pop esi
ret
Function at 0x4d76f3
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov ebx, ecx
push edi
push 0x5e9330
push dword [ebx + 0x30]
call fcn.004ddfd6
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x4d771b
xor al, al
jmp 0x4d78be
push 0x38
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0052c4e0
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x4d773f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x40], eax
jmp 0x4d7742
mov dword [ebp - 0x40], edi
test esi, esi
je 0x4d7752
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
jmp 0x4d7755
mov dword [ebp - 0x3c], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], 1
mov dword [ebp - 8], fcn.00402532
test esi, esi
jne 0x4d7797
mov eax, 0x65c950
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov eax, 0x65c9b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jmp 0x4d781c
mov ecx, dword [0x65c67c]
lea edi, [esi + 0x48]
call fcn.004cb24e
test al, al
je 0x4d77b7
mov eax, dword [0x65c684]
test eax, eax
je 0x4d77b7
mov eax, dword [eax + 0x14]
jmp 0x4d77bf
mov eax, dword [0x65c67c]
mov eax, dword [eax + 0x10]
mov ecx, edi
mov dword [ebp - 0x34], eax
call fcn.004c4b7a
mov ecx, edi
mov dword [ebp - 0x30], eax
call fcn.004c37da
mov ecx, edi
mov dword [ebp - 0x2c], eax
call fcn.004c38db
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x22cc]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x1be8]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x1bec]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x1bf0]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x1bf4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x1bf8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x1bfc]
sub esp, 0x3c
mov dword [ebp - 0xc], eax
lea esi, [ebp - 0x40]
push 0xf
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [ebp - 4]
mov esi, dword [ebp + 8]
add esp, 0x3c
test eax, eax
setne al
mov byte [ebx + 0x34], al
test esi, esi
je 0x4d78bb
xor edi, edi
cmp dword [ebx + 0xb8], edi
je 0x4d78a4
cmp dword [ebx + 0xb4], edi
je 0x4d788b
mov eax, dword [0x65bc14]
cmp dword [eax + 0x28], 5
jb 0x4d787e
push 0x5e9390
push 0x5e93a8
push 0x97
push 0x5e93c0
push 5
push 0xa
call fcn.0049283a
add esp, 0x18
push edi
push dword [ebx + 0xb4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp + 8]
push eax
push edi
push ebx
push 0x4d7651
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xb4], eax
mov eax, dword [esi + 0x1bf8]
cmp dword [eax], edi
je 0x4d78bb
push dword [0x65c76c]
mov ecx, ebx
call fcn.004d7690
mov al, byte [ebx + 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4db0e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0xc
jge 0x4db0f7
xor eax, eax
jmp 0x4db214
mov eax, dword [0x65ca38]
push ebx
push esi
inc eax
push edi
xor edi, edi
mov dword [0x65ca38], eax
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x4db122
push edi
call fcn.0053e77f
xor eax, 0xbb40e64e
push eax
call fcn.0053f537
pop ecx
pop ecx
mov esi, dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004db23a
add esp, 0xc
call fcn.0053f516
sar eax, 7
push esi
push dword [ebp + 0x14]
movzx edx, al
mov dword [ebp + 0x10], edx
call fcn.004db218
push edx
push esi
push dword [ebp + 0x14]
mov ebx, eax
call fcn.004db276
mov eax, dword [ebp + 0x10]
add esp, 0x14
xor al, bl
mov byte [ebp + edi - 0x14], al
inc edi
cmp edi, 0xa
jl 0x4db134
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004db23a
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov edi, dword [ebp - 4]
add esp, 0xc
sub eax, ecx
mov dword [ebp - 8], eax
push esi
push dword [ebp + 0x14]
call fcn.004db218
movzx ecx, byte [ebp + edi - 0x14]
mov ebx, eax
push ecx
push esi
push dword [ebp + 0x14]
call fcn.004db276
mov cl, byte [ebp + edi - 0x14]
add esp, 0x14
mov eax, dword [ebp - 8]
xor cl, bl
add eax, edi
inc edi
mov byte [ebp + eax - 0x14], cl
cmp edi, 0xa
jl 0x4db186
push esi
push dword [ebp + 0x14]
call fcn.004db218
mov esi, dword [ebp + 0x1c]
mov ebx, esi
shr ebx, 0x10
movzx ecx, bl
push ecx
push dword [ebp + 0x18]
mov dword [ebp + 0x10], eax
push dword [ebp + 0x14]
call fcn.004db276
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x18]
xor bl, byte [ebp + 0x10]
push dword [ebp + 0x14]
mov byte [edi + eax], bl
call fcn.004db218
shr esi, 0x18
mov ebx, eax
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004db276
mov ecx, dword [ebp + 0xc]
add esp, 0x28
mov eax, esi
xor al, bl
mov byte [edi + ecx + 1], al
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db276
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [edi + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx ecx, al
mov eax, dword [ebp + 0x10]
xor edx, dword [esi + ecx*4]
mov dword [edi + 8], edx
pop edi
pop esi
pop ebp
ret
Function at 0x4db2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0xb660], ebx
je 0x4db32b
cmp dword [esi + 0x7c], ebx
jbe 0x4db32b
mov eax, 0xffffff5c
lea ecx, [esi + 0xb680]
sub eax, esi
lea edi, [esi + 0xa4]
mov dword [ebp + 8], eax
mov edx, dword [esi + 0xb68c]
push edx
push ecx
call fcn.004db218
mov ebx, eax
movzx eax, byte [edi]
push eax
push edx
lea eax, [esi + 0xb680]
push eax
call fcn.004db276
xor byte [edi], bl
lea ecx, [esi + 0xb680]
mov eax, dword [ebp + 8]
add esp, 0x14
inc edi
add eax, edi
cmp eax, dword [esi + 0x7c]
jb 0x4db2f2
mov ebx, dword [ebp - 4]
mov edi, dword [esi + 0x7c]
lea eax, [esi + 0xa4]
push edi
push eax
push dword [esi + 0x2c]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, edi
je 0x4db349
or ebx, 0xffffffff
add dword [esi + 0xb670], edi
mov ecx, dword [esi + 0x48]
push 0
pop eax
adc dword [esi + 0xb674], eax
add dword [esi + 0xb678], ecx
pop edi
adc dword [esi + 0xb67c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x7c], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1507
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x104
push ecx
or dword [edi + 0x4144], 0xffffffff
lea eax, [edi + 0x4040]
or dword [edi + 0x414c], 0xffffffff
push eax
mov dword [edi], ecx
mov dword [edi + 0x403c], ecx
mov byte [edi + 0x4148], cl
mov dword [edi + 0x4150], ecx
mov dword [edi + 0x4154], ecx
mov dword [edi + 0x4158], 0x402532
mov dword [edi + 0x415c], ecx
call fcn.0052c4e0
push 0x401c
lea ebx, [edi + 0x10]
push 0
push ebx
call fcn.0052c4e0
push 0x50
call fcn.005145dd
push 0x50
push 0
push eax
mov dword [edi], eax
call fcn.0052c4e0
push dword [ebp + 8]
mov edx, 0x4e1668
mov dword [edi + 4], 0x4e1928
mov ecx, 0x4e1676
mov dword [edi + 8], 0x4e195c
lea esi, [edi + 0xc]
mov dword [edi + 0x402c], edx
push esi
mov dword [edi + 0x4030], ecx
mov dword [edi + 0x4034], edx
mov dword [edi + 0x4038], ecx
call fcn.004e94ae
add esp, 0x30
cmp dword [esi], 0xffffffff
je 0x4e1645
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x403c], eax
lea eax, [ebp - 0x104]
push eax
lea eax, [edi + 0x4040]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0053e577
add esp, 0x14
call fcn.004e7540
push dword [edi]
call fcn.004e798f
push ebx
call fcn.004e73fb
push 0
push ebx
call fcn.004e73cc
lea eax, [edi + 4]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x4034]
push eax
lea eax, [edi + 0x402c]
push eax
push ebx
push dword [edi]
call fcn.004e79bb
add esp, 0x20
test eax, eax
jne 0x4e1642
mov byte [edi + 0x4148], 1
jmp 0x4e1645
and dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e7540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4e7548
mov dword [edx*4 + 0x65e3e0], ecx
inc edx
cmp edx, 0x100
jb 0x4e7543
mov esi, 0x800
jmp 0x4e7591
mov ecx, dword [edx*4 + 0x65dfe0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x65e3e0]
mov dword [edx*4 + 0x65e3e0], ecx
inc edx
cmp edx, esi
jb 0x4e7575
mov dword [0x65cac4], 0x505aa0
call fcn.00505919
pop esi
test eax, eax
jne 0x4e75b3
mov dword [0x65cac4], 0x505b39
ret
Function at 0x4ec021
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x30], 0
je 0x4ec071
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x28], esi
jne 0x4ec042
xor al, al
jmp 0x4ed122
mov ecx, dword [ebx + 0x1c]
mov dword [ebx + 0x28], esi
test ecx, ecx
je 0x4ec05a
push esi
call fcn.004ec021
test al, al
jne 0x4ed120
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x4ec03b
push esi
call fcn.004ec021
test al, al
jne 0x4ed120
jmp 0x4ec03b
call fcn.004edace
test al, al
je 0x4ec03b
mov eax, dword [0x65c6a8]
mov eax, dword [eax]
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
lea eax, [ebx + 0x40]
push eax
mov edx, dword [ecx]
call dword [edx + 0x25c]
mov eax, dword [ebx + 0x38]
push dword [ebx + 0x14]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x270]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
movzx eax, byte [ebx + 0x35]
neg eax
mov edx, dword [ecx]
sbb eax, eax
and eax, 6
push eax
call dword [edx + 0x27c]
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + 4]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
cmp eax, esi
jae 0x4ec0e8
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
mov ecx, dword [ebx + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4ec0f7
mov esi, dword [eax + 0x14]
mov dword [ebp + 8], esi
jmp 0x4ec0fb
or dword [ebp + 8], 0xffffffff
mov eax, dword [ebx + 0x38]
push edi
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x284]
mov edi, eax
mov dword [ebp - 8], edi
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
cmp eax, esi
jbe 0x4ec138
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
mov ecx, dword [ebx + 0xc]
mov dword [ecx + 8], eax
mov dl, byte [0x65c71d]
test dl, dl
je 0x4ec1ba
mov dh, byte [0x65c725]
test dh, dh
je 0x4ec18c
push edi
call fcn.004eda25
pop ecx
test al, al
je 0x4ec18c
mov eax, dword [0x65c6a4]
mov esi, dword [eax]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
mov ecx, dword [0x65c6a4]
add eax, 4
push eax
call dword [esi + 0x3c]
test al, al
jne 0x4ed103
mov dl, byte [0x65c71d]
mov dh, byte [0x65c725]
test dl, dl
je 0x4ec1ba
test dh, dh
je 0x4ec1ba
mov eax, dword [0x65c6a4]
mov esi, dword [eax]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x274]
mov ecx, dword [0x65c6a4]
push eax
call dword [esi + 0x3c]
test al, al
jne 0x4ed112
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x288]
mov ecx, dword [edi]
mov eax, ecx
shr eax, 0x1a
jmp dword [eax*4 + 0x4ed12d]
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x298]
jmp 0x4ed11f
mov ecx, dword [ebx + 0x38]
mov ecx, dword [ecx]
mov edx, dword [ecx]
call dword [edx + 0x294]
pop edi
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x51032f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x510350
xor eax, eax
jmp 0x5104b2
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
mov edx, dword [ebp + 8]
push ebx
or ebx, 0xffffffff
add ecx, edx
mov dword [ebp - 8], ecx
push 3
pop eax
add edx, edi
mov dword [ebp - 4], edx
cmp edx, ecx
jae 0x510382
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x51037c
inc edx
cmp edx, ecx
jb 0x51036f
push 3
mov dword [ebp - 4], edx
pop eax
mov edi, edx
sub edi, dword [ebp + 8]
cmp edx, ecx
jae 0x510496
mov ecx, edi
sub ecx, ebx
cmp ecx, eax
jbe 0x5103b9
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test al, al
je 0x5103f8
cmp al, 0xff
je 0x5103f8
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x510489
dec ecx
shl esi, cl
and esi, 7
je 0x510399
movzx eax, byte [esi + 0x5eded8]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x5eded0], 0
mov al, byte [ecx + 4]
je 0x5103e0
test al, al
je 0x5103e0
cmp al, 0xff
jne 0x510399
mov ecx, dword [ebp - 8]
mov ebx, edi
mov edx, dword [ebp + 8]
push 3
pop eax
and esi, eax
add esi, esi
or esi, 1
inc edi
jmp 0x510366
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 0x10]
shl ebx, 8
or ebx, eax
cmp dword [ebp + 0x18], 0
je 0x510425
add ebx, edi
add ebx, edx
jmp 0x510429
sub ebx, edi
sub ebx, edx
mov dword [ebp + 0xc], ebx
test esi, esi
je 0x51045f
movzx eax, byte [esi + 0x5eded8]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x51044e
cmp al, 0xff
jne 0x51045f
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0xc]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp + 0xc]
jmp 0x510419
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
mov ecx, dword [ebp - 8]
add edi, eax
mov edx, dword [ebp + 8]
jmp 0x510363
mov edx, edi
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp eax, edx
mov eax, dword [ebp + 0x14]
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5178c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x547c99
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00547b18

Function at 0x54fcc7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054f987