joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493ecc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov ebx, 0x545800
mov eax, 0x547800
add edx, 0x10
dec dword [esp]
mov ecx, dword [edx]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx], esi
mov ecx, dword [edx + 4]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 8], esi
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 0xc], esi
cmp dword [esp], 1
jne 0x493edd
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x49435c
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
add eax, 0x20
xor ecx, ecx
mov edx, 0x4c
call fcn.00482084
ret
Function at 0x4944e4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov dword [ebx + 0x48], 0x67452301
mov dword [ebx + 0x4c], 0xefcdab89
mov dword [ebx + 0x50], 0x98badcfe
mov dword [ebx + 0x54], 0x10325476
mov dword [ebx + 0x40], esi
cmp esi, 0x40
jl 0x494529
mov edx, edi
lea eax, [ebx + 0x48]
call fcn.00493338
add edi, 0x40
sub esi, 0x40
cmp esi, 0x40
jge 0x494514
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00482178
mov edi, ebx
add edi, esi
mov byte [edi], 0x80
inc edi
mov eax, 0x37
sub eax, esi
mov esi, eax
test esi, esi
jl 0x494556
mov eax, edi
xor ecx, ecx
mov edx, esi
call fcn.00482084
jmp 0x49457a
lea edx, [esi + 8]
mov eax, edi
xor ecx, ecx
call fcn.00482084
mov edx, ebx
lea eax, [ebx + 0x48]
call fcn.00493338
mov eax, ebx
xor ecx, ecx
mov edx, 0x38
call fcn.00482084
mov esi, dword [ebx + 0x40]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
mov dword [ebx + 0x38], eax
shr esi, 0x1d
mov dword [ebx + 0x3c], esi
mov edx, ebx
lea eax, [ebx + 0x48]
call fcn.00493338
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x48]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4b8650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053b4
xor eax, eax
push ebp
push 0x4b8749
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004b7d54
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040abe8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b9020
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aaa8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b9098
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8750
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f58
ret
Function at 0x4b8758
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053b4
xor eax, eax
push ebp
push 0x4b8861
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004b7d54
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4b8827
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040abe8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b9020
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aaa8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b9098
jmp 0x4b8839
xor edx, edx
mov eax, ebx
call fcn.004b9020
xor edx, edx
mov eax, ebx
call fcn.004b9098
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8868
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f58
ret

Function at 0x4bf0b8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004bf2f4
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004bf2f4
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4bf12c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4bf152
inc esi
mov eax, edi
call fcn.004bf110
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004bf0b8
inc ebx
dec esi
jne 0x4bf13b
pop edi
pop esi
pop ebx
ret
Function at 0x4bf1e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004053b4
xor eax, eax
push ebp
push 0x4bf25e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004bf158
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004bf110
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004bf0b8
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4bf228
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf265
lea eax, [ebp - 4]
call fcn.00404f34
ret
Function at 0x4bfef8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c00de
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c009a
mov eax, dword [ebp - 4]
call fcn.004c18a0
cmp ebx, eax
jge 0x4c009a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004b6738
mov edx, dword [0x4b80f0]
call fcn.004041c4
mov esi, eax
mov eax, esi
call fcn.004b8fb4
test al, al
je 0x4c0090
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4c0084
xor eax, eax
push ebp
push 0x4c007d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c04b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00421048
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405654
mov eax, dword [ebp - 8]
call fcn.00405424
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c0274
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c00c8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c007c
mov eax, dword [ebp - 4]
call fcn.004c0534
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040afec
jmp 0x4c00c8
mov eax, dword [ebp - 8]
call fcn.00404f34
jmp 0x4c00c8
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a3c0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41baec]
call fcn.0040e510
call fcn.00404888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c00e5
lea eax, [ebp - 0x54]
call fcn.00404f34
ret
Function at 0x4c4e58
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4c4ef2
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4c4e77
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4c4f08
dec edx
je 0x4c4f3d
jmp 0x4c4f8e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4c4f8e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c72d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4c72fe
mov ecx, 0x4c7360
mov dl, 1
mov eax, dword [0x4c68e4]
call fcn.0040e4d4
call fcn.00404888
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4c734d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403334
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4c730e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c7378
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4c73a2
mov ecx, 0x4c740c
mov dl, 1
mov eax, dword [0x4c68e4]
call fcn.0040e4d4
call fcn.00404888
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4c73fa
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403334
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4c73b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c79c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c7a4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c6c08]
mov eax, 0x14
call fcn.00405ecc
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004098e8
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404f88
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x547fa0]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x547fa0], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7a51
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f58
ret
Function at 0x4c7a58
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4c7ad4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c6c30]
mov eax, 0x10
call fcn.00405ecc
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004098e8
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404f88
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x547fa4]
mov dword [ebx], eax
mov dword [0x547fa4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7adb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f58
ret

Function at 0x4c7b30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4c7b51
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4c7b3e
pop edi
pop esi
pop ebx
ret
Function at 0x4d9118
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x547fdc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d913a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d913c
shr eax, 1
dec edx
jne 0x4d9128
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d9121
mov byte [0x5483dc], 1
pop esi
pop ebx
ret

Function at 0x4d9158
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5483dc], 0
jne 0x4d916f
call fcn.004d9118
mov eax, edi
dec eax
test eax, eax
jl 0x4d9197
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x547fdc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d9179
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4dbe34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4dbece.0
jmp dword [ecx*4 + 0x4dbe67]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4dbe99
sub dl, 8
je 0x4dbea8
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbae0
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbb38
jmp case.0x4dbece.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4dbece.0
movzx ecx, byte [ecx + 0x4dbed5]
jmp dword [ecx*4 + 0x4dbee6]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbbe4
jmp case.0x4dbece.0
cmp dl, 3
jne 0x4dbf13
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbc38
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbbf4
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbc7c
jmp case.0x4dbece.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4dbf3e
sub dl, 8
je 0x4dbf4a
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbca8
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbd14
jmp case.0x4dbece.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4dbf69
sub dl, 8
je 0x4dbf75
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbdd0
jmp case.0x4dbece.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4dbdf8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x14]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x454]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4dc013
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004daff0
test eax, eax
je 0x4dc013
mov eax, ebx
call fcn.004dc01c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4dbfac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dc01c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4dc04d
dec al
je 0x4dc088
dec al
je 0x4dc0cd
dec al
je 0x4dc136
jmp 0x4dc1c0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4dc1c0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4dc05d
jmp 0x4dc1c0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4dc1c0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4dc098
jmp 0x4dc1c0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4dc1c0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4dc0fc
xor ebp, ebp
jmp 0x4dc10c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4dc115
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4dc0dd
jmp 0x4dc1c0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4dc1c0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4dc18f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d91a0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4dc14a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret