joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432f6c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004057f4
xor eax, eax
push ebp
push 0x4331c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.004053c8
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x433199
cmp dword [0x4a18f0], 0
jne 0x432fd1
call fcn.00433fe8
cmp dword [0x4a18f0], 0
je 0x433199
xor eax, eax
push ebp
push 0x433180
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x43316f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x4331dc
call fcn.0040540c
mov edx, dword [ebp - 4]
mov eax, 0x4331ec
call fcn.00405950
mov esi, eax
test esi, esi
jle 0x433030
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040586c
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.004058ac
cmp dword [ebp - 4], 0
jne 0x433050
mov dl, 1
mov eax, ebx
call fcn.0042d628
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.00409878
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4a18f0]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0042dccc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004053c8
mov eax, dword [0x4a18f0]
cmp byte [eax + 0x13], 0
je 0x4330bc
push 0x4331f8
push dword [ebp - 4]
push 0x43320c
push ebx
push 0x43320c
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00405708
mov eax, dword [ebp - 0x1c]
call fcn.00405804
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x433109
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.004053c8
mov eax, dword [0x4a18f0]
cmp byte [eax + 0x11], 0
je 0x4330f3
push dword [ebp - 4]
push 0x433218
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00405708
mov byte [ebp - 0xd], 0
call fcn.00404d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x433199
mov byte [ebp - 0xd], 1
mov eax, dword [0x4a18f0]
cmp byte [eax + 0x11], 0
je 0x433132
push dword [ebp - 4]
push 0x433224
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00405708
lea eax, [ebp - 8]
call fcn.00405374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433176
mov eax, dword [0x4a18f0]
cmp dword [eax + 0x16], 0
je 0x43316e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x4a18f0]
call dword [ebx + 0x16]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004053c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4331c8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405398
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405398
ret
Function at 0x433e6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x433f62
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x433f78
call fcn.0040540c
push 5
lea eax, [ebp - 0xe]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete bl
test bl, bl
je 0x433ed2
push 5
lea eax, [ebp - 9]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
je 0x433ed6
xor eax, eax
jmp 0x433ed8
mov al, 1
mov ebx, eax
test bl, bl
je 0x433ef3
lea eax, [ebp - 4]
lea edx, [ebp - 0xe]
call fcn.0040556c
mov eax, esi
lea edx, [ebp - 9]
call fcn.0040556c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004091fc
mov eax, dword [ebp - 0x14]
mov edx, 0x433f84
call fcn.0040579c
jne 0x433f35
lea edx, [ebp - 0x18]
mov eax, dword [esi]
call fcn.004091fc
mov eax, dword [ebp - 0x18]
mov edx, 0x433f90
call fcn.0040579c
jne 0x433f35
mov eax, edi
mov edx, dword [0x4a18f4]
call fcn.004053c8
jmp 0x433f3f
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004053c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433f69
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405398
lea eax, [ebp - 4]
call fcn.00405374
ret
Function at 0x43745c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x43763c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4374b9
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x4374cc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x4374cc
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43751c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf9], 0
jne 0x43751c
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x43752c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf9]
test eax, eax
je 0x43752c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43762b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf9], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00439d7c
cmp dword [0x4adc2c], 0
je 0x43756e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4adc2c]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00439d7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x43f]
test eax, eax
je 0x437593
xor edx, edx
call fcn.00435048
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x4375bf
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x4375d8
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437632
cmp dword [ebp - 0x10], 0
je 0x437617
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf9], edx
jmp 0x43762a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x43762a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf9], edx
ret
Function at 0x43825c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x808], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43830f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
jne 0x4382a6
lea edx, [ebp - 0x808]
mov eax, ebx
call fcn.00438448
mov edx, dword [ebp - 0x808]
mov eax, esi
call fcn.00405d10
jmp 0x4382f6
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x4382f6
cmp byte [ebx + 0x431], 0
jne 0x4382f6
push eax
call sub.user32.dll_GetWindowTextLengthW
cmp eax, 0x400
jle 0x4382cb
mov eax, 0x400
test eax, eax
jle 0x4382f6
inc eax
push eax
lea eax, [ebp - 0x802]
push eax
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, esi
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.00405cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438316
lea eax, [ebp - 0x808]
call fcn.00405374
ret

Function at 0x438448
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438503
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
je 0x438487
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043825c
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.004383e0
jmp 0x4384ed
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x4384e0
cmp byte [ebx + 0x431], 0
jne 0x4384e0
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4384ad
xor esi, esi
jmp 0x4384ca
mov eax, dword [ebp - 4]
inc eax
call fcn.00402edc
mov esi, eax
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, edi
mov edx, esi
call fcn.0040556c
test esi, esi
je 0x4384ed
mov eax, esi
call fcn.00402ef8
jmp 0x4384ed
mov eax, edi
mov edx, dword [ebx + 0x425]
call fcn.0040556c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43850a
lea eax, [ebp - 8]
call fcn.00405b50
ret
Function at 0x43b5f4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00405374
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43b643
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x43b63e
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x43b63e
push esi
call fcn.004221b4
mov edi, eax
test edi, edi
je 0x43b63e
mov eax, ebx
mov edx, edi
call fcn.0040556c
push esi
call fcn.00422208
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret

Function at 0x43b648
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b71b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43b6de
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x43b6de
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43b6d7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x43b6ad
mov eax, dword [ebp - 8]
push eax
call fcn.004221b4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00405cac
jmp 0x43b6b5
mov eax, dword [ebp - 4]
call fcn.00405b50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b6de
cmp dword [ebp - 8], 0
je 0x43b6d1
mov eax, dword [ebp - 8]
push eax
call fcn.00422208
call sub.user32.dll_CloseClipboard
ret
cmp dword [ebp - 8], 0
je 0x43b6f2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
xor edx, edx
call fcn.00405e54
jne 0x43b705
lea eax, [ebp - 0xc]
call fcn.0043b5f4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00405d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b722
lea eax, [ebp - 0xc]
call fcn.00405374
ret

Function at 0x43b7a8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x43b85e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43b848
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.00405e54
je 0x43b841
lea eax, [ebp - 4]
mov edx, edi
call fcn.004055fc
mov eax, dword [ebp - 4]
call fcn.0043b728
mov eax, edi
call fcn.00405d30
inc eax
add eax, eax
push eax
push 0x2000
call fcn.00422160
mov esi, eax
test esi, esi
je 0x43b843
push esi
call fcn.004221b4
mov ebx, eax
mov eax, edi
call fcn.00405d30
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00405d20
mov edx, ebx
pop ecx
call fcn.004030cc
push esi
call fcn.00422208
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x43b843
mov bl, 1
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b865
lea eax, [ebp - 4]
call fcn.00405374
ret
Function at 0x442a30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.004057f4
xor eax, eax
push ebp
push 0x442a94
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00405804
push eax
mov eax, esi
call fcn.00405804
push eax
mov eax, ebx
call fcn.00405804
push eax
push 0x442aa4
push edi
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442a9b
lea eax, [ebp + 8]
call fcn.00405374
ret

Function at 0x442f14
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push ebp
push 0x442f63
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test bl, bl
jne 0x442f55
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x442f55
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00442eb8
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442f6a
ret

Function at 0x443120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057f4
xor eax, eax
push ebp
push 0x4431d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x4431ab
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409580
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040540c
cmp dword [ebp - 4], 0
jne 0x44317f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4431b5
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405804
push eax
push 0x4431e8
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4431b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4431da
lea eax, [ebp - 0xc]
call fcn.00405374
lea eax, [ebp - 4]
call fcn.00405374
ret

Function at 0x444170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4441cc
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x44419b
call fcn.0040ee58
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030cc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4441cc
call fcn.0040ee58
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x445b74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x445ba3
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x445c22
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00444430
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x445bf0
mov cx, word [esp]
sub cx, si
jmp 0x445bf2
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x445bd9
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x445c18
mov cx, word [esp]
sub cx, si
jmp 0x445c1a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x445c01
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x445c7f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00445848
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x445c6a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x445c7f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x445b7e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44c200
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4addd0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x44c222
shr eax, 1
xor eax, 0xedb88320
jmp 0x44c224
shr eax, 1
dec edx
jne 0x44c210
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x44c209
mov byte [0x4ae1d0], 1
pop esi
pop ebx
ret

Function at 0x44c240
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4ae1d0], 0
jne 0x44c257
call fcn.0044c200
mov eax, edi
dec eax
test eax, eax
jl 0x44c27f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4addd0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x44c261
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x44ee60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45e]
movzx ecx, dl
cmp ecx, 6
ja case.0x44eefa.0
jmp dword [ecx*4 + 0x44ee93]
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44eec5
sub dl, 8
je 0x44eed4
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb0c
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb64
jmp case.0x44eefa.0
movzx ecx, byte [eax + 0x45d]
cmp ecx, 0x10
ja case.0x44eefa.0
movzx ecx, byte [ecx + 0x44ef01]
jmp dword [ecx*4 + 0x44ef12]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec10
jmp case.0x44eefa.0
cmp dl, 3
jne 0x44ef3f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec64
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec20
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eca8
jmp case.0x44eefa.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44ef6a
sub dl, 8
je 0x44ef76
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ecd4
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ed40
jmp case.0x44eefa.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44ef95
sub dl, 8
je 0x44efa1
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44edfc
jmp case.0x44eefa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ee24
mov edx, dword [eax + 0x462]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x44d]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x451]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x449]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x44f045
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x49]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0044e018
test eax, eax
je 0x44f045
mov eax, ebx
call fcn.0044f050
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x462]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x44efde
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44f050
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x44f081
dec al
je 0x44f0bc
dec al
je 0x44f101
dec al
je 0x44f16a
jmp 0x44f1f4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x44f1f4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44f091
jmp 0x44f1f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f1f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44f0cc
jmp 0x44f1f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f1f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x44f130
xor ebp, ebp
jmp 0x44f140
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x44f149
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f111
jmp 0x44f1f4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f1f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x44f1c3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0044c2f4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f17e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret