joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498ee4
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
mov dword [esp + 0x10], ebp
push 0xfffffffffffffffd
pop esi
test edi, edi
je 0x499058
cmp dword [edi + 0x88], 0
jne 0x499058
cmp dword [edi + 0xe0], 0
jne 0x499058
mov ecx, dword [edi + 0x98]
call fcn.0048ecf6
mov ebx, eax
test ebx, ebx
je 0x499058
cmp dword [ebx + 0x28], 3
jne 0x498f7c
mov ecx, dword [ebx + 0x24]
mov edx, 0x72557c
movzx eax, word [ecx]
cmp ax, word [edx]
jne 0x498f7c
movzx eax, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x498f7c
cmp dword [esp + 0x18], 0
jle 0x498f6c
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebp
push edi
call fcn.00498e5c
add esp, 0x14
jmp 0x499041
cmp dword [esp + 0x20], 0
je 0x499048
jmp 0x49903a
mov ebp, dword [esp + 0x18]
test ebp, ebp
jle 0x498ffa
push 0x748
push 0x725580
push 1
push 0x10
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x499060
push ebp
push str._X_r_n
push 0x10
push esi
call fcn.0040117f
push 0
push 0
push eax
push esi
push edi
call fcn.00498e5c
add esp, 0x24
cmp eax, 0xfffffffc
je 0x498ff7
push 0
push dword [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push edi
call fcn.00498e5c
add esp, 0x14
cmp eax, 0xfffffffc
je 0x498ff7
push 0
push 1
push 2
push 0x72560c
push edi
call fcn.00498e5c
add esp, 0x14
mov esi, eax
jmp 0x498ffa
push 0xfffffffffffffffc
pop esi
cmp dword [esp + 0x20], 1
jne 0x499043
cmp esi, 0xfffffffc
je 0x499036
cmp esi, 0xfffffffe
je 0x499036
cmp dword [ebx + 4], 4
jne 0x499026
push 4
push str.HEAD
push dword [ebx]
call fcn.00600990
add esp, 0xc
test eax, eax
je 0x499036
push 1
push 1
push 5
push str.0_r_n_r_n
jmp 0x498f5e
test esi, esi
js 0x499043
mov ecx, edi
call fcn.00498967
mov esi, eax
cmp esi, 1
je 0x499058
cmp dword [edi + 0xb0], 0
je 0x499058
and dword [edi + 0xb0], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x748
push esi
push edi
mov edx, 0x7255a0
xor ecx, ecx
call fcn.00488a50
push edi
push 0x7255c0
push 0x7255e0
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x49922f
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebp, edx
push 0x94
push 0x7256a4
push 1
lea ebx, [edi + 1]
mov dword [esp + 0x1c], ecx
push ebx
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49927b
mov eax, dword [esp + 0x10]
mov edx, ebx
add eax, ebp
mov ecx, esi
push edi
push eax
call section..text
pop ecx
pop ecx
mov byte [esi + edi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfe
mov edx, 0x7256c8
push eax
push esi
xor ecx, ecx
lea edi, [esi - 0x6a]
push edi
call fcn.00488a50
push edi
push 0x7256ec
push 0x725710
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x49a375
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x353
push 0x725b14
push 1
mov ebx, 0x80
mov edi, ecx
push ebx
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49a480
push ebx
push 0
push esi
call fcn.005b5fd0
add esp, 0xc
mov ecx, str.ILibWrapper_WebRTC_ConnectionFactory
call fcn.00480fb6
mov edx, esi
mov dword [esi + 0x18], eax
mov ecx, edi
mov dword [esi + 8], 0x499da6
call fcn.004819aa
push ecx
mov ecx, edi
call fcn.004963b1
mov dword [esi + 0x24], eax
pop ecx
test eax, eax
jne 0x49a3f5
mov ecx, dword [edi + 0x500]
mov edx, esi
call fcn.004872c8
push 1
push esi
call fcn.005e7dd0
pop ecx
xor eax, eax
jmp 0x49a47a
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.00499c91
cmp dword [esp + 0x14], 1
je 0x49a417
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x40]
mov ecx, dword [esi + 0x24]
push eax
call fcn.0049632f
pop ecx
mov eax, dword [esi + 0x24]
mov edx, 0x48f39d
push 0
push 0x10
pop ecx
mov dword [eax + 0x13c], 0x49a055
mov dword [eax + 0x140], 0x49a0a9
mov dword [eax + 0x144], 0x49a12c
mov eax, dword [esi + 0x24]
mov dword [eax + 0x1b0], 0x49a1a8
mov dword [eax + 0x1b4], 0x49a15e
mov dword [eax + 0x1b8], 0x49a2b1
mov dword [eax + 0x1ac], fcn.004011c0
call fcn.004878eb
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x10], edi
pop ecx
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0x354
push edi
push esi
mov edx, 0x725b38
xor ecx, ecx
call fcn.00488a50
add esp, 0xc
push esi
push 0x725b5c
push 0x725b80
call fcn.00401109
add esp, 0xc
push edi
call fcn.005c3000
int3

Function at 0x49a96a
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
mov dword [esp + 0xc], edx
push edi
push 0x4c
pop ecx
mov edx, dword [ebx - 0xc]
call fcn.004815ba
mov ecx, str.ILibWrapper_WebRTC_DataChannel
mov edi, eax
call fcn.00480fb6
mov ebp, dword [esp + 0x18]
push 0x4ef
push 0x725e38
push 1
lea esi, [ebp + 1]
mov dword [edi + 0x18], eax
push esi
mov dword [edi + 0x44], ebx
call fcn.005e7f10
add esp, 0x10
mov dword [edi + 0x38], eax
test eax, eax
je 0x49aa18
push ebp
push dword [esp + 0x14]
mov edx, esi
mov ecx, eax
call section..text
mov eax, dword [edi + 0x38]
mov esi, dword [esp + 0x24]
mov byte [eax + ebp], 0
mov word [edi + 0x34], si
mov dword [edi + 0x3c], 0x47b36b
mov ecx, dword [ebx + 0x74]
call fcn.00487ca2
movzx edx, word [edi + 0x34]
mov ecx, dword [ebx + 0x74]
push edi
call fcn.00487972
mov eax, dword [ebx + 0x74]
mov ecx, edi
mov dword [eax + 0xc], 0
call fcn.004991fc
mov ecx, dword [ebx]
mov edx, esi
push ebp
push dword [esp + 0x20]
call fcn.00495102
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x4ef
push esi
push edi
mov edx, 0x725e5c
xor ecx, ecx
call fcn.00488a50
push edi
push str...microstackILibWrapperWebRTC.c
push 0x725ea4
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x49aa51
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [esp + 0x20]
push eax
xor esi, esi
xor eax, eax
push 0x6bb308
inc eax
mov dword [esp + 0x28], esi
push eax
push esi
push 0x6bb2e8
mov ebp, edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov ebx, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call edi
test eax, eax
js 0x49ab56
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x49ab56
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x49ab56
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
js 0x49ab56
lea eax, [esp + 0x10]
push eax
push 0x6bb328
push 1
push esi
push 0x6bb2f8
call edi
test eax, eax
js 0x49ab56
push ebp
mov ebp, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebp
mov edi, eax
test edi, edi
je 0x49ab56
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x49ab46
push 0x6bb1a0
call ebp
mov esi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x49ab46
mov ecx, dword [esp + 0x10]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x20]
test eax, eax
js 0x49ab46
mov eax, dword [esp + 0x14]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
push 1
pop eax
cmovns ebx, eax
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
test esi, esi
je 0x49ab56
push esi
call edi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x49ab64
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x49ab72
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x49ab80
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x49ab8e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [esp + 0x20]
test edx, edx
je 0x49ab9c
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x49b1e3
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x49b244
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005b35b0
mov esp, ebp
pop ebp
ret

Function at 0x49b253
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
lea ebp, [esp - 0x290]
sub esp, 0x310
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push ebx
push esi
push edi
push 0x168
lea eax, [ebp - 0x44]
xor ebx, ebx
push eax
push ebx
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x49b2ec
push 0x38
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x3c
push ebx
push eax
call fcn.005b5fd0
add esp, 0xc
mov dword [ebp - 0x78], ebx
test edi, edi
mov dword [ebp - 0x64], 1
mov edi, 0x72c000
mov ecx, str.runas
mov eax, str.open
push 0x1000
push edi
push 0xffffffffffffffff
cmove eax, ecx
push esi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x44]
push ebx
push 0xfde9
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x6c], edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x49b2ee
xor eax, eax
mov ecx, dword [ebp + 0x28c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b35b0
lea esp, [ebp + 0x290]
pop ebp
ret
Function at 0x4c1050
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4c1077
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4c1066
pop edi
movzx eax, dl
pop esi
ret
Function at 0x4e3390
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.005b3d10
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4e351b
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, 0x10
jb 0x4e3410
mov eax, esi
shr eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
sub edx, ebp
sub eax, ebp
mov ecx, ebp
mov dword [esp + 0x14], eax
mov ebx, 4
mov esi, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [esi + ecx - 4], eax
sub ebx, 1
jne 0x4e33d7
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edx, edi
sub esi, 0x10
add esp, 0xc
add ebp, 0x10
mov dword [esp + 0x30], esi
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x4e33c4
test esi, esi
je 0x4e350a
mov ebx, edi
mov ecx, edx
sub ebx, ebp
sub ecx, ebp
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 1
mov dword [esp + 0x20], ecx
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov ebx, 2
sub ebx, ebp
mov dword [esp + 0x18], ebx
mov ebx, 3
sub ebx, ebp
mov dword [esp + 0x1c], ebx
nop dword [eax + eax]
cmp eax, esi
jae 0x4e34c2
mov esi, dword [esp + 0x14]
lea ebx, [eax + ebp]
mov cl, byte [ecx + ebx]
xor cl, byte [ebx]
mov byte [esi + ebx], cl
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
add ecx, ebx
cmp ecx, esi
jae 0x4e34c1
mov cl, byte [eax + ebp + 1]
xor cl, byte [eax + edx + 1]
mov byte [edi + eax + 1], cl
mov ecx, dword [esp + 0x18]
add ecx, ebx
cmp ecx, esi
jae 0x4e34bc
mov cl, byte [eax + ebp + 2]
xor cl, byte [eax + edx + 2]
mov byte [edi + eax + 2], cl
mov ecx, dword [esp + 0x1c]
add ecx, ebx
cmp ecx, esi
jae 0x4e34b7
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + edx + 3]
mov byte [edi + eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x20]
cmp eax, 0x10
jb 0x4e3450
jmp 0x4e34e1
add eax, 3
jmp 0x4e34c2
add eax, 2
jmp 0x4e34c2
inc eax
cmp eax, 0x10
jae 0x4e34e1
mov ebx, 0x10
lea ecx, [eax + edi]
sub edx, edi
sub ebx, eax
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub ebx, 1
jne 0x4e34d3
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov edx, edi
cmp esi, 0x10
jbe 0x4e350a
sub esi, 0x10
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x30], esi
test esi, esi
jne 0x4e3418
mov eax, dword [esp + 0x38]
pop edi
pop ebp
pop ebx
cmp eax, edx
je 0x4e351b
movups xmm0, xmmword [edx]
movups xmmword [eax], xmm0
pop esi
add esp, 0x14
ret
Function at 0x4e3640
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.005b3d10
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x4e368d
mov edx, dword [esp + 0x30]
test esi, esi
je 0x4e368d
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebp], al
inc ecx
inc ebp
mov dword [esp + 0x10], ecx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x4e3670
mov ebx, dword [esp + 0x2c]
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x4e3747
mov edi, ebx
nop
mov ebx, esi
shr ebx, 4
add edx, ebx
mov dword [esp + 0x24], edx
cmp edx, ebx
jae 0x4e36d7
sub ebx, edx
xor edx, edx
mov dword [esp + 0x24], edx
push edi
push dword [esp + 0x2c]
push ebx
push ebp
push ecx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x4e3729
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + edi - 1]
dec edx
add ecx, eax
mov byte [edx + edi], cl
shr ecx, 8
test edx, edx
jne 0x4e3713
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
shl ebx, 4
sub esi, ebx
add ecx, ebx
add ebp, ebx
mov dword [esp + 0x10], ecx
cmp esi, 0x10
jae 0x4e36c0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x2c]
test esi, esi
je 0x4e37b5
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ebx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
inc ecx
mov eax, ecx
mov byte [ebx + 0xf], cl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xe], al
test ecx, ecx
jne 0x4e3792
push ebx
call fcn.00522af0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
mov edx, dword [esp + 0x10]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebp - 1], al
sub esi, 1
jne 0x4e37a3
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4e40c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x38]
or eax, dword [ebx + 0x3c]
je 0x4e40d4
mov eax, 0xfffffffe
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, esi
add eax, dword [ebx + 0x30]
adc ecx, dword [ebx + 0x34]
cmp ecx, 0x20000000
ja 0x4e4189
jb 0x4e40f9
test eax, eax
jne 0x4e4189
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [ebx + 0x16c]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
test edi, edi
je 0x4e4139
nop
test esi, esi
je 0x4e4125
mov al, byte [ebp]
dec esi
xor byte [edi + ebx + 0x40], al
inc ebp
inc edi
and edi, 0xf
jne 0x4e4110
jmp 0x4e4129
test edi, edi
jne 0x4e417c
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004e5750
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x4e415e
push eax
push ebp
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004e5510
add ebp, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x4e417c
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x4e417c
nop word [eax + eax]
mov al, byte [ecx + ebp]
xor byte [ebx + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x4e4170
mov dword [ebx + 0x16c], edi
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x4e52c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.005b3d10
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x4e532c
mov eax, dword [esp + 0x20]
mov ebx, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x4e5485
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x4c], 0
push ebp
mov ebp, dword [esp + 0x24]
push edi
lea edi, [esi + 0x40]
cmp ebx, 0x10
jb 0x4e53cc
lea eax, [esi + 0x60]
mov dword [esp + 0x14], eax
lea ecx, [esi + 0x41]
mov eax, ebx
mov dword [esp + 0x18], ecx
shr eax, 4
mov esi, edi
mov dword [esp + 0x2c], eax
mov eax, ecx
lea edx, [ebp + 1]
mov edi, 4
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub edi, 1
jne 0x4e5380
push dword [esp + 0x14]
push esi
call fcn.004e5750
mov ecx, dword [esp + 0x20]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x2c], 1
jne 0x4e5373
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x40]
test ebx, ebx
je 0x4e53ee
xor ecx, ecx
test ebx, ebx
je 0x4e53e1
mov al, byte [ecx + ebp]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x4e53d6
lea eax, [esi + 0x60]
push eax
push edi
call fcn.004e5750
add esp, 8
mov ebx, dword [esp + 0x1c]
xor edx, edx
shld edx, ebx, 3
xor byte [esi + 0x4b], dl
mov eax, edx
shr eax, 0x18
xor byte [esi + 0x48], al
mov eax, edx
shr eax, 0x10
xor byte [esi + 0x49], al
mov eax, edx
shr eax, 8
xor byte [esi + 0x4a], al
mov eax, edx
shl ebx, 3
xor byte [esi + 0x4f], bl
mov ecx, ebx
shrd ecx, eax, 0x18
xor byte [esi + 0x4c], cl
mov ecx, ebx
shr eax, 0x18
mov eax, edx
shrd ecx, eax, 0x10
xor byte [esi + 0x4d], cl
shr eax, 0x10
mov eax, ebx
shrd eax, edx, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
shr edx, 8
push edi
call fcn.004e5750
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
pop edi
mov dword [esi + 0xc], eax
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4e5750
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.005b3d10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x668048]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x668048]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x668048]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x4e57f0
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x4eaee0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.0051f380
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.005b66b0
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x4eaf86
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004af2c0
push 0x668154
push esi
push 0x668158
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.004aea20
add esp, 0x2c
call fcn.005e4ae0
cmp dword [eax], 2
je 0x4eaf6b
call fcn.005e4ae0
cmp dword [eax], 6
je 0x4eaf6b
push edi
push edi
push 2
push 0x6d
push 0x20
call fcn.004af2c0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push 0
push 0x80
push 0x6d
push 0x20
call fcn.004af2c0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x668114
call fcn.004b6210
mov esi, eax
add esp, 4
test esi, esi
jne 0x4eafa8
push edi
call fcn.005e1d40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.004b5b30
push edi
push ebx
push 0x6a
push esi
call fcn.004b5b60
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret