joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e960
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x45e9a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x45ee20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x481340
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0045e9d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0045ea50
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0045ea50
lea ecx, [esi + 0xc]
call fcn.0047263f
lea ecx, [esi + 0x10]
call fcn.0047263f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0045fff0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0045fff0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0045fff0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004726b4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004726b4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x474a5b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x474a93
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00472b0f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00472ae7
jmp 0x474a9f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47614d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47618f
call fcn.0047bec8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47618f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x476186
xor eax, eax
jmp 0x476197
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047619d
pop edi
pop esi
pop ebx
ret 4

Function at 0x47c3f8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47c426
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47c444
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047c35e
jmp 0x47c444
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c444
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047c35e
test edi, edi
mov eax, edi
jne 0x47c42e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
push esi
mov esi, dword [ebp + 8]
not esi
jne 0x10317
xor eax, eax
jmp 0x104af
push 0x10
pop eax
cmp dword [ebp + 0x10], eax
mov ecx, 0xff
jb 0x1048b
push ebx
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 1]
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 2]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 3]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 4]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 5]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 6]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 7]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 8]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 9]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xa]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xb]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xc]
shr esi, 8
xor edi, esi
sub dword [ebp + 0x10], eax
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xd]
shr edi, 8
xor esi, edi
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xe]
shr esi, 8
xor edi, esi
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x13630]
xor ebx, ebx
mov bl, byte [edx + 0xf]
shr edi, 8
xor esi, edi
add edx, eax
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x13630]
shr esi, 8
xor esi, edi
cmp dword [ebp + 0x10], eax
jae 0x1032a
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x104ab
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x13630]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x10491
mov eax, esi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x11ffc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 5
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x12028
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
jmp 0x1202b
or eax, 0xffffffff
leave
ret 8
Function at 0x12030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x18]
push esi
xor esi, esi
cmp eax, esi
push esi
jne 0x12044
push esi
jmp 0x1204e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
pop esi
jl 0x12076
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x12078
xor eax, eax
leave
ret 0x14

Function at 0x1292c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x206b6444
xor ebx, ebx
mov edi, 0x1000
push edi
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
jne 0x1295f
xor eax, eax
jmp 0x12ab3
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00011ffc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x129d7
cmp ebx, edi
jb 0x129d7
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push dword [ebp + 8]
call fcn.00012030
test eax, eax
je 0x129d7
mov ax, word [esi]
cmp ax, 0x5a4d
je 0x1299a
cmp ax, reloc.ntoskrnl.exe_MmMapLockedPages
jne 0x129d7
mov eax, dword [esi + 0x3c]
lea ecx, [ebx - 0x18]
cmp eax, ecx
ja 0x129d7
mov ecx, ebx
sub ecx, eax
cmp ecx, edi
jae 0x129ae
mov edi, ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp + 8]
call fcn.00012030
test eax, eax
je 0x129d7
cmp dword [esi], 0x4550
jne 0x129d7
cmp word [esi + 4], 0x14c
jne 0x129d7
test byte [esi + 0x17], 0x20
jne 0x129e0
and dword [ebp - 4], 0
jmp 0x12aa9
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
cmp ecx, eax
jb 0x12aa2
mov edx, dword [esi + 0x1c]
add edx, eax
cmp ecx, edx
ja 0x12aa2
movzx eax, word [esi + 0x14]
movzx ecx, word [esi + 6]
xor edi, edi
add eax, 0x18
xor edx, edx
inc edi
test ecx, ecx
jbe 0x12a80
mov dword [ebp + 8], 0xffffffdc
sub dword [ebp + 8], esi
lea ecx, [eax + esi + 0x24]
jmp 0x12a22
xor edi, edi
inc edi
mov ebx, dword [ebp + 8]
add ebx, ecx
cmp ebx, 0xfd8
ja 0x12a7b
mov edi, dword [ecx]
mov dword [ebp - 8], edi
and dword [ebp - 8], 0x20000000
je 0x12a44
inc dword [ebp - 0xc]
test edi, edi
js 0x12aa2
test edi, edi
jns 0x12a4b
inc dword [ebp - 0x10]
mov edi, dword [ecx - 0x18]
cmp dword [esi + 0x28], edi
jb 0x12a6c
mov ebx, dword [ecx - 0x1c]
add ebx, edi
cmp dword [esi + 0x28], ebx
ja 0x12a6c
cmp dword [ebp - 8], 0
je 0x12aa2
movzx edi, word [esi + 6]
dec edi
cmp edx, edi
je 0x12aa2
movzx edi, word [esi + 6]
inc edx
add ecx, 0x28
cmp edx, edi
jb 0x12a1f
xor edi, edi
inc edi
cmp dword [ebp - 0xc], edi
ja 0x12a9d
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*8]
lea eax, [eax + esi - 0x28]
mov eax, dword [eax + 0x24]
test al, 0x20
jne 0x12a9d
test eax, 0xa0000000
jne 0x12a9d
cmp dword [ebp - 0x10], edi
jbe 0x12aa9
mov dword [ebp - 4], edi
jmp 0x12aa9
mov dword [ebp - 4], 1
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x132fc
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
push ebx
push esi
push edi
push 8
pop ecx
xor ebx, ebx
mov esi, 0x132b4
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 0xa
pop ecx
mov esi, 0x132d4
lea edi, [ebp - 0x5c]
mov dword [ebp - 4], ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax]
and eax, 0xffff
mov dword [0x14730], eax
mov dword [0x13fb0], ebx
mov byte [0x141a0], bl
mov byte [0x14920], bl
call fcn.00010ac7
cmp eax, ebx
mov dword [0x13ebc], eax
jne 0x1335f
mov eax, 0xc0000001
jmp 0x134cb
mov esi, dword [sym.imp.ntoskrnl.exe_KeInitializeSpinLock]
mov eax, 0x14848
mov dword [0x1484c], eax
mov dword [0x14848], eax
mov eax, 0x14850
push 0x14734
mov dword [0x14854], eax
mov dword [0x14850], eax
call esi
push 0x13eb4
call esi
mov esi, dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor edi, edi
push ebx
inc edi
mov eax, 0x14900
push edi
push 0x13fcc
mov dword [0x14904], eax
mov dword [0x14900], eax
mov dword [0x13fc0], edi
mov dword [0x13fc8], ebx
call esi
push ebx
mov eax, 0x13fe8
push edi
push 0x13eec
mov dword [0x13fec], eax
mov dword [0x13fe8], eax
mov dword [0x13ee0], edi
mov dword [0x13ee8], ebx
call esi
push ebx
mov eax, 0x13ea8
push edi
push 0x1486c
mov dword [0x13eac], eax
mov dword [0x13ea8], eax
mov dword [0x14860], edi
mov dword [0x14868], ebx
call esi
push ebx
push edi
push 0x14890
mov dword [0x13ea0], ebx
call esi
push 0x148c0
call dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov dword [0x14880], ebx
call fcn.0001098a
call fcn.00011cd8
call fcn.00011d44
call fcn.000108ae
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
push eax
call edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8300
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x13476
push esi
call fcn.00012118
mov eax, dword [ebp + 8]
jmp 0x134cb
mov eax, 0x1288e
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x70], 0x130fe
mov dword [esi + 0x34], 0x12926
call fcn.000108ae
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
cmp edi, ebx
jge 0x134ba
push esi
call fcn.00012118
jmp 0x134c9
call fcn.000108ae
call fcn.00011b08
call fcn.00011ee2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4dfd84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0xd7133c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4dfe48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4dfdbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4dfe5f
dec edx
je 0x4dfea0
jmp 0x4dfefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4dfefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dff60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4dff7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4e008f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4dffb0
je 0x4dfffc
sub ecx, 0x2b
je 0x4dfff2
sub ecx, 4
je 0x4dfff7
dec ecx
sub ecx, 0xa
jb 0x4dffe1
jmp 0x4dffff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4dffc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4dffd0
jmp 0x4dffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4dffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4dffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4dffff
mov byte [eax], 0x3e
jmp 0x4dffff
mov byte [eax], 0x3f
jmp 0x4dffff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4dff8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4e004f
cmp byte [esp + 3], 0xff
jne 0x4e004f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4e0087
cmp dl, 0xff
je 0x4e0087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4dff88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4e011c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0xd827a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4e0138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4e013a
shr eax, 1
dec edx
jne 0x4e012b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4e0124
pop ebx
ret
Function at 0x4e0150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4e0159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d7a38
xor eax, eax
push ebp
push 0x4e0239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004e011c
mov eax, dword [0xd81e0c]
mov byte [eax], 0
mov dword [ebx], reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [ebp - 4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004d5e7c
mov edx, 1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004d6218
call fcn.004d5ba8
test eax, eax
jne 0x4e0216
lea eax, [ebp - 8]
push eax
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov ecx, 0xfff1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004d5fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4e0210
lea eax, reloc.RASAPI32.dll_RasHangUpA
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4e01ec
cmp dword [ebp - 8], 0
jne 0x4e01c3
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.004d5fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0240
lea eax, [ebp - 4]
call fcn.004d7588
ret

Function at 0x4eb718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4eb738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4eb726
pop edi
pop esi
pop ebx
ret
Function at 0x4f3fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0xd82cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004f3f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004f3fac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004f3f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004f3fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004f3f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004f3fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004f3f70
mov edi, eax
mov eax, edi
call fcn.004f3fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4f3fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f4138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4f416d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4f4193
inc ebx
cmp ebx, 0xf
jne 0x4f417d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4f414f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6a2b48
Capabilities:
Encode data using xor

Disassembly:
jmp 0x68c556
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x68c572
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x68c55e
jmp 0x68c57d
ret
lea esp, [esp + 4]
jmp 0x68c54b

Function at 0x6a2b8d
Capabilities:
Check for trap flag exception

Disassembly:
pushal
lea esp, [esp + 0x20]
call fcn.006a2b48

Function at 0x6be705
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [esi + 0xe]
xchg edi, ecx
lea edi, [ebp*4]
mov byte [esi + 0x5e], al
jmp 0x6be725
lea esp, [esp + 8]
mov byte [esi + 0x5d], dl
dec cx
xor edi, esi
jmp 0x6be6e2
Function at 0xdc4e13
Capabilities:
Encrypt data using aes

Disassembly:
pushal
lea esp, [esp + 1]
jmp 0xdc4e81
sub esp, 0xa
lea esp, [esp + 9]
jmp 0xdc4dfc
mov edi, edx
and edx, esi
call fcn.00dc4e1c
shr edi, 0x18
sub esp, 0xe
mov word [esp + 0xa], dx
push dword [esp + 8]
stc
jmp 0xdc4ead
and edi, 0xff000000
push edx
xor ecx, edi
mov di, word [esp]
mov edi, dword [esp]
jmp 0xdc4e32
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
lea esp, [esp + 0x54]
and ecx, 0xff0000
jmp 0xdc4e62
mov dword [esp + 0x13], esi
jmp 0xdc4ee4
lea esp, [esp + 2]
lea esp, [esp + 0x18]
movzx edi, byte [edi*4 + 0xda2140]
pushal
mov byte [esp + 0xd], ah
jmp 0xdc4e94
sub esp, 0x14
xor ecx, edx
lea esp, [esp + 0x34]
xor ecx, dword [ebx]
jmp 0xdc4ef1
xor ecx, edi
mov di, word [esp]
and edx, ebp
lea edi, [ebx + ebx]
jmp 0xdc4ec4
dec di
lea edi, [eax + 0x10]
bswap edx
xor ecx, dword [eax]
jmp 0xdc665c
mov edx, dword [eax + 4]
call fcn.00dc5241
mov edx, edi
mov dword [edx], ecx
pop edx
mov dx, 0x57cd
neg dh
jmp 0xdc5a34
mov edx, dword [esp]
btc edx, ebx
mov edx, 0x1d874c3c
push edx
jmp 0xdc636a
lea edx, [ecx*4]
neg dx
lea edx, reloc.RASAPI32.dll_RasHangUpA
add ebx, 4
lea edx, [ebx*4]
jmp 0xdc6596

Function at 0xdc4e1c
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xdc4e3b

Function at 0xdc52db
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x24]
jle 0xd97e52
mov dx, word [esp]
jmp 0xdc52c0

Function at 0xdc5858
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 2
call fcn.00dc5821
rcl dword [esi - 0x3c], cl
mov dword [reloc.RASAPI32.dll_RasHangUpA], eax
pop ebx
int 0x7f
out dx, al
stc
fdivr dword [ebx]
pushal
mov dword [esp + 0xf], esi
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xdc5840

Function at 0xdc5866
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xdc587c
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sete bl
jmp 0xdc5959
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
and edx, ecx
lea esp, [esp + 0x3c]
jmp 0xdc589b
and edx, ecx
pushal
sub esp, 0x12
mov word [esp + 0x16], sp
lea esp, [esp + 2]
jmp 0xdc58b2
lea ebx, reloc.RASAPI32.dll_RasHangUpA
movzx ebx, byte [esi + 0xd]
sub esp, 0x1c
lea esp, [esp + 0xd]
lea esp, [esp + 3]
jmp 0xdc58ff