joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5661c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00565c10
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x566204
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x566204
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x566208
xor eax, eax
jmp 0x566286
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00551105
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x566240
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x56622a
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.00566377
push ebx
mov edi, eax
call fcn.0055112e
test edi, edi
pop ecx
je 0x566282
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00566140
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0056628b
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret

Function at 0x418d87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x418d96
pop dword [ebp - 0x38]
mov eax, 0x28d67ee3
add eax, 0xd76b0eb3
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3cf9c
push 0
mov eax, 0x455f0a74
sub eax, 0x451cb954
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x7dd4e873
add ecx, 0x822b61bc
mov esi, eax
mov edx, 0xa39989b2
add edx, 0x5ca9a44e
add edx, dword [ebp - 0x38]
mov ebx, 0xe8317690
sub ebx, 0x557bf687
xor dword [ebp - 0x34], edi
mov edi, dword [edx]
xor dword [ebp - 0x1c], 0xe115bd00
xor edi, ebx
add dword [ebp - 0xc], 0x75d87cdd
mov dword [esi], edi
add dword [ebp - 0x2c], ecx
add esi, 0x16eb4596
sub esi, 0x16eb4592
add edx, 4
loop 0x418df5
add eax, 0x11b8f
xor ebx, ebx
add ebx, eax
add eax, 0x2f161924
sub eax, 0x2f16191f
mov ecx, 0xc75ec135
sub ecx, 0xc71ec135
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10068c30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101f3dec
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x10068cbd
push edi
push 0
push 1
push 0x101f7e54
call esi
cmp eax, 1
jne 0x10068c7a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101f7e54
call esi
cmp eax, 1
je 0x10068c66
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101f3dec
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x10068ca7
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x10068ca7
push esi
push 0x101f3dec
call edi
push 0
push 0x101f7e54
call edi
pop edi
cmp esi, 0xffffffff
jne 0x10068cbd
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101f3dec]
test eax, eax
js 0x10068ce1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10068ce1
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10068cb6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
push esi
mov dword [ebx], 1
push dword [0x101f3dec]
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x1006e5a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
push edi
test eax, eax
jns 0x1006e5ae
xor edi, edi
jmp 0x1006e5b7
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
xor ecx, ecx
lea edx, [edi + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10027c6c], esi
jne 0x1006e5ce
cmp dword [edx], 0
jne 0x1006e5e4
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x1006e5c0
mov ecx, dword [edi + 0x20]
push 0x10
push esi
call fcn.100be9f0
pop edi
ret
mov edx, dword [edi + ecx*8 + 0x24]
test edx, edx
je 0x1006e600
mov eax, dword [edx]
mov dword [edi + ecx*8 + 0x24], eax
test eax, eax
jne 0x1006e5fa
mov dword [edi + ecx*8 + 0x28], eax
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jae 0x1006e5d7
mov eax, edx
pop edi
ret

Function at 0x1006f290
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1006f2e5
mov eax, dword [0x101f3dec]
push ebx
push edi
test eax, eax
jns 0x1006f2a3
xor edi, edi
jmp 0x1006f2ac
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
mov ebx, dword [esi + 4]
push dword [ebx*4 + 0x10027c6c]
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + ebx*8 + 0x28]
add esp, 0xc
test eax, eax
je 0x1006f2db
mov dword [eax], esi
mov dword [edi + ebx*8 + 0x28], esi
pop edi
pop ebx
ret
mov dword [edi + ebx*8 + 0x24], esi
mov dword [edi + ebx*8 + 0x28], esi
pop edi
pop ebx
ret
Function at 0x100efc70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100efc7d
xor eax, eax
jmp 0x100efc84
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.100be9f0
test eax, eax
je 0x100efcc8
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x10041660
mov dword [eax + 4], 2
mov dword [eax + 0x18], 0x11
mov dword [eax + 0x18], edi
ret
mov byte [esi + 0x248], 1
xor eax, eax
ret

Function at 0x100f08b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100f08bd
xor eax, eax
jmp 0x100f08c4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.100be9f0
test eax, eax
je 0x100f090b
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x100415f0
mov dword [eax + 4], 5
mov dword [eax + 0x18], 0
mov dword [eax + 0x18], esi
mov dword [esi + 0x10], eax
ret
mov byte [edi + 0x248], 1
xor eax, eax
ret

Function at 0x100f5a90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x100f5abc
push ebx
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + ebx + 0x10]
test ecx, ecx
je 0x100f5ab2
push 1
call fcn.100be9f0
inc esi
add ebx, 0x18
cmp esi, dword [edi + 4]
jb 0x100f5aa0
pop ebx
mov esi, dword [edi + 0xc]
test esi, esi
je 0x100f5aec
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100f5ada
xor eax, eax
push esi
push eax
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push esi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret

Function at 0x1014ccf0
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi], 0
je 0x1014cd3a
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x1014cd03
xor eax, eax
jmp 0x1014cd0a
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
movzx ecx, word [esi]
cmp ecx, dword [eax + 0x128]
ja 0x1014cd2f
mov edx, dword [edi]
add ecx, ecx
push ebx
mov ebx, dword [eax + 0x124]
test edx, edx
je 0x1014cd2e
mov eax, dword [ebx + ecx*8 - 0xc]
mov dword [edx], eax
mov dword [ebx + ecx*8 - 0xc], edx
pop ebx
mov word [esi], 0
mov dword [edi], 0
ret
Function at 0x101e8aec
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
push edi
mov ebx, ecx
cmp edx, 0x35
jne 0x101e8b51
push edx
call fcn.100be9f0
mov eax, dword [esi + 0x4cc]
shr eax, 2
add eax, 2
push eax
mov ecx, ebx
call fcn.100be9f0
xor edi, edi
test dword [esi + 0x4cc], 0xfffffffc
jbe 0x101e8d21
mov eax, dword [esi + 0x4d0]
push dword [eax + edi*4]
mov ecx, ebx
call fcn.100be9f0
mov eax, dword [esi + 0x4cc]
inc edi
shr eax, 2
cmp edi, eax
jb 0x101e8b2e
jmp 0x101e8d21
xor eax, eax
cmp eax, dword [esi + 0x48c]
mov eax, edx
sbb edi, edi
and edi, 0x80000000
and eax, 0x7ff
or edi, eax
push 3
pop ecx
cmp edx, 0x1f
jg 0x101e8b93
je 0x101e8b85
sub edx, ecx
je 0x101e8b85
dec edx
dec edx
je 0x101e8b85
sub edx, ecx
je 0x101e8b85
sub edx, 5
jne 0x101e8c04
mov eax, dword [esi + 0x4c8]
and eax, 1
shl eax, 0x12
jmp 0x101e8c02
sub edx, 0x3d
je 0x101e8bf7
dec edx
dec edx
je 0x101e8b85
sub edx, 0x30
je 0x101e8bf7
sub edx, 0x4f
jne 0x101e8c04
movzx ecx, byte [esi + 0x4ca]
movzx eax, byte [esi + 0x4cb]
neg ecx
sbb ecx, ecx
and ecx, 0x4000
neg eax
sbb eax, eax
and eax, 0x2000
or ecx, eax
movzx eax, byte [esi + 0x4c9]
neg eax
sbb eax, eax
and eax, 0x1000
or ecx, eax
movzx eax, byte [esi + 0x4c8]
neg eax
sbb eax, eax
and eax, 0x800
or ecx, eax
and ecx, 0x7800
or edi, ecx
jmp 0x101e8c04
mov eax, dword [esi + 0x4c8]
and eax, ecx
shl eax, 0xb
or edi, eax
mov ecx, dword [esi + 0x4c4]
mov eax, dword [esi + 0x490]
neg ecx
sbb ecx, ecx
and ecx, 0x2000
and eax, 0xf
shl eax, 0x13
or ecx, eax
or ecx, edi
push ecx
mov ecx, ebx
call fcn.100be9f0
xor eax, eax
mov ecx, eax
mov dword [ebp - 8], eax
mov dword [ebp + 8], ecx
lea edx, [esi + 0x494]
mov edi, dword [esi + 0x48c]
mov dword [ebp - 4], edx
cmp edi, 3
jae 0x101e8c4e
mov eax, edi
jmp 0x101e8c51
push 3
pop eax
cmp ecx, eax
jae 0x101e8cf8
mov eax, dword [edx]
mov edx, eax
and edx, 0x3f
dec eax
je 0x101e8ca3
dec eax
je 0x101e8c84
dec eax
jne 0x101e8cd0
push 6
pop ecx
mov eax, dword [esi + ecx + 0x4a6]
and eax, 0xf
shl eax, cl
add ecx, 4
or edx, eax
cmp ecx, 0x16
jb 0x101e8c6c
jmp 0x101e8cd0
mov ecx, dword [esi + 0x4a8]
mov eax, dword [esi + 0x4a4]
and ecx, 0xfff
shl ecx, 5
and eax, 0x1f
or ecx, eax
shl ecx, 6
jmp 0x101e8cce
movsx ecx, byte [esi + 0x4a2]
movsx eax, byte [esi + 0x4a1]
and ecx, 0xf
shl ecx, 4
and eax, 0xf
or ecx, eax
movsx eax, byte [esi + 0x4a0]
shl ecx, 4
and eax, 0xf
or ecx, eax
shl ecx, 9
or edx, ecx
mov eax, dword [ebp + 8]
inc eax
cmp eax, edi
mov dword [ebp + 8], eax
sbb eax, eax
and eax, 0x80000000
or eax, edx
push eax
mov ecx, ebx
call fcn.100be9f0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add edx, 4
jmp 0x101e8c3c
cmp dword [esi + 0x488], 0
jbe 0x101e8d21
lea edi, [esi + 8]
push edi
mov ecx, ebx
call fcn.100be9f0
mov eax, dword [ebp - 8]
inc eax
add edi, 0xc0
mov dword [ebp - 8], eax
cmp eax, dword [esi + 0x488]
jb 0x101e8d04
mov ecx, ebx
call fcn.100cb050
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40ca69
test eax, edx
je 0x40ca6c
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c9e9
push edx
mov edx, eax
mov eax, esp
call fcn.00406b50
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c9ff
push eax
lea eax, [esp + 8]
call fcn.00406b50
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40ca0e
movzx eax, word [eax]
sub eax, ecx
jmp 0x40ca35
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40ca4f
add ecx, 4
js 0x40ca26
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40ca4c
push eax
mov eax, ecx
mov edx, 2
call fcn.00405d38
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40ca33
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40ca35
xor eax, eax
ret
test eax, eax
je 0x40ca7c
test edx, edx
jne 0x40c9d0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x414cb7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004060d4
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00409afc
mov edi, eax
cmp edi, 0x104
jbe 0x414cda
mov eax, edi
add eax, eax
call fcn.00403c4c
mov esi, eax
jmp 0x414cdc
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00409afc
push edi
push esi
call fcn.00409e84
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x414d15
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x414cff
mov eax, esp
cmp esi, eax
je 0x414d22
mov eax, esi
call fcn.00403c68
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x414d5c
cmp bl, 0
je 0x414d58
cmp bl, 0x41
jl 0x414d53
cmp bl, 0x5a
jg 0x414d53
or bl, 0x20
xor al, bl
inc esi
jmp 0x414d37
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x414c9c

Function at 0x42be24
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42be2a
ret
Function at 0x4863f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x51f1dc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x486412
shr eax, 1
xor eax, 0xedb88320
jmp 0x486414
shr eax, 1
dec edx
jne 0x486400
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4863f9
mov byte [0x51f5dc], 1
pop esi
pop ebx
ret

Function at 0x486430
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x51f5dc], 0
jne 0x486447
call fcn.004863f0
mov eax, edi
dec eax
test eax, eax
jl 0x48646f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51f1dc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x486451
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4891bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja 0x489307
jmp dword [ecx*4 + 0x4885ef]
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x48939f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00488368
test eax, eax
je 0x48939f
mov eax, ebx
call fcn.004893a8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x489338
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4893a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4893d9
dec al
je 0x489414
dec al
je 0x489459
dec al
je 0x4894c2
jmp 0x48954c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x48954c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4893e9
jmp 0x48954c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48954c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x489424
jmp 0x48954c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48954c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x489488
xor ebp, ebp
jmp 0x489498
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4894a1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x489469
jmp 0x48954c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48954c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x48951b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00486478
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4894d6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4991ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49921a
mov eax, ebx
call fcn.00499ca0
cmp dword [ebx + 0x40], 0
je 0x499213
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49928b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x49927d
cmp dword [ebx + 8], 0
je 0x49923c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49924e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49927d
cmp dword [ebx + 8], 0
je 0x49922f
cmp eax, 3
je 0x499261
dec eax
jne 0x49922f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49922f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49922f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4992a9
cmp dword [ebx + 0x14], 0xcc
je 0x4992a9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004992b4
pop ebx
ret
Function at 0x4b4ced
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x4b6552
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4b6600
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x4b6591
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.004b4dcd
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.004b49cc
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4b65bc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.004b4ced
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.004b4d31
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x4b661b
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b4d31
add esp, 0xc
pop ecx
pop ebp
ret

Function at 0x4b661e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4b663f
push dword [ebp + 0x10]
push 0
push 0
call fcn.004b6552
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004b4dcd
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4b6657
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.004b4ced
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.004b4d31
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.004b4d31
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004b4dcd
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x4b66de
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x4b66c3
mov esp, ebp
pop ebp
ret