joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x5df1fb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x5df233
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x5df221
mov al, 1
jmp 0x5df27d
cmp dword [ebx + 0x54], ecx
jne 0x5df22a
mov al, 2
jmp 0x5df27d
cmp dword [ebx + 0x7c], ecx
jne 0x5df27d
mov al, 3
jmp 0x5df27d
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x5df248
mov al, 4
jmp 0x5df27d
cmp ecx, 5
jne 0x5df268
cmp ebx, 0
jne 0x5df256
mov al, 5
jmp 0x5df27d
cmp ebx, 1
jne 0x5df25f
mov al, 6
jmp 0x5df27d
cmp ebx, 2
jne 0x5df268
mov al, 7
jmp 0x5df27d
cmp ecx, 6
jne 0x5df274
cmp ebx, 0
jne 0x5df276
mov al, 8
jmp 0x5df27d
cmp ebx, 1
jne 0x5df27d
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x558300
Capabilities:
Encode data using xor

Disassembly:
cmp cl, byte [edi - 0x254112ba]
xor dword [ebx - 0x27a81f2b], 0xffffffbd
and bl, al
push ss
xchg edi, ebp
mov esi, 0xd5b383da
loopne 0x5582b5
fdivr dword [ebp - 0x78e927de]
out dx, eax
xchg esp, eax
inc edx
les ecx, [edx - 0x2b4100]
stc
or ebp, ecx
jmp 0xe487fcc7
rcr byte [eax + 0x35], cl
jmp 0x558253
jge 0x558257
jne 0x5582d2
add byte [ebx - 0x5f51d2cc], cl
add dword [esi + edx + 0x6e], ebp
pop eax
stosb byte es:[edi], al
jno 0x55833d
pushfd
int1
dec ebx
invalid
pushal
mov eax, 0x41afab0a
xor byte [edx], bh
ret
xchg edi, eax
sbb ch, byte [eax + 0x2fa060c3]
mov dl, 0xb8
mov eax, 0x13c6540
mov eax, 0x13c6540
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x558380
arpl word [edx + esi], si
jo 0x5582bb
mov edi, 0xa43c36fb
cmp al, 0xa4
iretd
sar dword [edx - 0x4a], cl
pop eax
or dl, byte [edx + 0xc]
jp 0x558327
mov bl, 0x4e
enter 0x25d8, 0x70
or al, 0x90
aas
pop ebx
xchg esp, eax
add bh, byte [ebx]
or ebx, dword [eax - 0x1e4854a4]
sub ecx, dword [edx]
add al, 8
inc ebx
xor eax, 0x3c144f37
outsb dx, byte [esi]
add esp, dword [ecx]
xor byte [ecx + 0x64d2748], cl
loopne 0x558349
ja 0x5583be
rol byte [ebx], 1
jne 0x5582f8
popal
pop es
out dx, al
outsb dx, byte [esi]
mov esp, 0xb53baf2e
rcl dword [edx + esi*8], 0x19
and dword [edi], ebp
dec esi
dec esp
push ss
jns 0x55838f
invalid
adc dword [edi - 0xf], esp
or ch, byte [edi]
cmovae ebp, dword [esi + eax*2 - 0x5375f486]
dec ecx
mov byte [0x4c064bf1], al
pushal
pop eax
mov bh, 0xf9
cmpsd dword [esi], dword es:[edi]
pop edi
push ebp
bswap esp
cld
and ch, 0xbb
invalid
mov eax, dword [0x4b3df260]
scasb al, byte es:[edi]
adc ebp, dword [ecx]
dec edi
and dword [eax], 0x20
hlt
Function at 0x64e3ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
jmp 0x64e3b3
not dh
mov edx, 0x27d5765c
sub esp, 0x1a
inc esi
mov esi, 0xf19f5ea8
xchg dword [esp + 0xb], esi
jmp 0x64e414
mov edx, 0xfd3fae70
mov dh, byte [esp + 0x13]
mov word [esp + 0xf], bx
rdtsc
mov si, 0xcc55
mov al, ah
jmp 0x64e3ee

Function at 0x64e5a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 0xf]
mov byte [esp + 0x11], dh
pop dword [esp + 2]
mov al, 0xa6
and dh, bh
clc
jmp 0x64e5d0
bt edx, edx
push word [esp + 2]
lea edx, [ebp - 0xbf]
mov eax, dword [esp + 0xe]
mov byte [esp + 0xd], bh
jmp 0x64e567
rdtsc
sub esp, 0xe
jmp 0x64e587

Function at 0x64eaee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 0x17]
push dword [esp + 0x1a]
rol dh, 3
xchg dh, al
jmp 0x64ebbd
lea edx, [edi*4]
xchg dword [esp + 2], esi
not eax
pop word [esp + 0x1e]
lea esp, [esp + 0x1f]
jmp 0x64eb79
xchg word [esp + 0x29], si
mov esi, 0x477930c
pop word [esp + 5]
add esp, 0x20
sub esp, 0x12
xchg dh, dl
jmp 0x64eb42
pop word [esp + 3]
bsf dx, ax
mov byte [esp + 3], ah
xor esi, esi
xchg ah, dh
mov ax, 0x265
jmp 0x64ebe7
mov dh, bh
mov byte [esp + 0x1d], bh
push dword [esp + 7]
inc ax
sub esp, 0x16
cmc
jmp 0x64eb60
mov word [esp + 0x19], dx
lea edx, [eax + ebx]
xchg esi, eax
add eax, ecx
mov byte [esp + 0x15], bh
not ax
jmp 0x64eb97
bsf ax, ax
not edx
lea edx, reloc.WINMM.dll_midiStreamOut
xchg ah, dh
jmp 0x64ec3a
xchg word [esp + 1], ax
neg eax
mov si, word [esp + 4]
mov dx, 0x4d4b
jmp 0x64ebd1
btr eax, edx
mov word [esp], dx
mov dword [esp + 3], eax
xor edx, esi
mov dx, word [esp]
sbb ax, 0xf884
jmp 0x64ec50
setge dh
setne dh
mov edx, 0x5c04491c
push word [esp + 1]
not dh
mov dl, dh
jmp 0x64ec11
add esp, 5
xchg word [esp], ax
mov edx, edi
inc al
mov dh, 0x5a
lea esi, [eax - 9]
jmp 0x64f49e
mov byte [esp + 1], ch
Function at 0x64ee97
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax*4]
bswap edx
push esp
not ah
sub esp, 0xe
rol dh, 3
jmp 0x64ee9e
lea esp, [esp]
bswap esi
mov dh, byte [esp]
cmc
rdtsc
bsr ax, bp
jmp 0x64ee4a
xchg esi, eax
pop eax
clc
bswap edx
xchg ah, dh
cld
jmp 0x64ee66
bswap edx
mov al, ah
clc
jmp 0x64ee7d
pop dword [esp + 5]
xchg word [esp + 8], dx
mov dh, byte [esp + 0xc]
lea esi, [ecx + 0x73]
neg edx
mov si, ax
jmp 0x64f1a0
mov esi, dword [esp + 3]
lea eax, [ebx + edi]
mov dword [esp + 3], esi
add esp, 1
lea esp, [esp + 6]
sub eax, ebp
jmp 0x64ef7b
rdtsc
mov dh, 0xf8
pop word [esp + 3]
bsf ax, si
pop word [esp + 5]
jmp 0x64ef00
bsr ax, cx
lea edx, [ebp - 0x47]
shl dh, 3
rdtsc
mov eax, dword [esp + 9]
bswap edx
jmp 0x64ef29
push edx
push word [esp + 1]
xchg esi, eax
mov eax, dword [esp + 6]
xchg edx, esi
rdtsc
jmp 0x64f03e
mov esi, dword [esp]
neg esi
mov al, 0xd6
lea esp, [esp]
xchg byte [esp], dh
neg dh
jmp 0x64ef57
mov dh, ch
sub esp, 8
clc
pop dword [esp + 4]
inc ax
mov al, 0xde
jmp 0x64ef43
lea eax, [edx*4]
xchg word [esp + 1], ax
mov eax, dword [esp + 3]
pop esi
mov esi, 0x40c627de
bsr dx, cx
call fcn.0064efc6
pop ax
push dword [esp + 2]
add esp, 1
pop eax
cmc
mov dl, dh
jmp 0x64f091
xor dx, 0xbb08
rdtsc
mov word [esp + 4], sp
rcr esi, 3
pop word [esp + 1]
not si
jmp 0x64efdd
mov edx, dword [esp + 4]
mov edx, 0x255b772c
bsr dx, bp
lea edx, [ebx*4]
sub si, 0x1440
mov dl, 4
jmp 0x64f016
rdtsc
pop word [esp]
mov si, bp
xchg ah, dh
call fcn.0064f072
add esp, 7
mov dh, byte [esp + 2]
pop si
sbb edx, ebp
lea esp, [esp + 4]
xchg dx, ax
jmp 0x64f106
push word [esp + 3]
xchg edx, eax
xchg word [esp + 1], si
mov ax, di
mov edx, ebx
add esp, 1
jmp 0x64ef99
mov dx, 0xb089
call fcn.0064f0f0
inc dh
mov dword [esp + 3], eax
mov si, bx
mov eax, ecx
setae dh
add esp, 0x1f
jmp 0x64f0d7
mov dword [esp + 2], ecx
lea eax, [eax*4]
mov eax, edx
add esp, 1
mov word [esp + 0xa], sp
sub esp, 0x18
jmp 0x64f125

Function at 0x64f5df
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp], esi
mov word [esp], di
lea esp, [esp + 0x35]
lea esp, [esp + 1]
mov dword [esp + 0xc], esi
push esp
mov dword [esp], eax
jmp 0x64f5c0
Function at 0x4a2c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
call dword [0x410058]
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.004ab0a0
mov dword [esp], 0x413244
push ebx
call fcn.004ab020
pop ecx
test eax, eax
pop ecx
jne 0x4a2d0a
push 0x413240
push ebx
call fcn.004ab020
pop ecx
test eax, eax
pop ecx
jne 0x4a2d0a
push 0x41323c
push ebx
call fcn.004ab020
pop ecx
test eax, eax
pop ecx
jne 0x4a2d0a
push 0x413238
push ebx
call fcn.004ab020
pop ecx
test eax, eax
pop ecx
jne 0x4a2d0a
push esi
mov esi, dword [0x4101c0]
push 0x7f02
push eax
call esi
push 0x7f00
push 0
mov dword [0x415b90], eax
call esi
mov dword [0x415b94], eax
call fcn.004a2d25
test eax, eax
pop esi
jne 0x4a2c9c
push 0xffffffffffffffff
call fcn.004aaf40
push 0x413234
push ebx
call fcn.004ab020
pop ecx
test eax, eax
pop ecx
je 0x4a2ccb
push 0x413230
push ebx
call fcn.004ab020
pop ecx
pop ecx
test eax, eax
jne 0x4a2cf5
push ebx
push dword [ebp + 8]
call fcn.004a4e75
pop ecx
pop ecx
jmp 0x4a2d03
push 0
push 0x401243
call dword [0x4101c4]
push eax
push 0x65
push dword [ebp + 8]
call dword [0x4101c8]
cmp eax, 0xffffffff
jne 0x4a2cf0
push 0xfffffffffffffffe
call fcn.004aaf40
cmp eax, 1
jmp 0x4a2cbc
push 1
push ebx
push dword [ebp + 8]
call fcn.004a9681
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret 0x10
push 0x30
push 0x41321c
push 0x41307c
push 0
call dword [0x4101cc]
push 0
call fcn.004aaf40
Function at 0x4db8ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x48
push 0x1004eba0
push edi
xor ebx, ebx
call 0x503bf8
mov esi, 0x400
lea eax, [edi + 0x48]
push esi
push 0x1004ebe8
push eax
call 0x503bf8
lea eax, [edi + 0x448]
push esi
push 0x1004efe8
push eax
call 0x503bf8
lea eax, [edi + 0x848]
push esi
push 0x1004f3e8
push eax
call 0x503bf8
lea eax, [edi + 0xc48]
push esi
push 0x1004f7e8
push eax
call 0x503bf8
add esp, 0x3c
mov ecx, edi
mov dword [ebp - 4], 0x12
xor esi, esi
mov dword [ebp + 8], 4
mov eax, dword [ebp + 0xc]
shl esi, 8
movzx eax, byte [ebx + eax]
or esi, eax
lea eax, [ebx + 1]
cdq
idiv dword [ebp + 0x10]
dec dword [ebp + 8]
mov ebx, edx
jne 0x4db927
xor dword [ecx], esi
add ecx, 4
dec dword [ebp - 4]
jne 0x4db91e
push 8
lea eax, [ebp - 0xc]
push 0
push eax
call 0x503f38
add esp, 0xc
mov esi, edi
push 9
pop ebx
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.004db13d
pop ecx
xor eax, eax
mov ah, byte [ebp - 0xc]
pop ecx
movzx ecx, byte [ebp - 0xb]
or eax, ecx
movzx ecx, byte [ebp - 0xa]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 9]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 7]
mov dword [esi], eax
add esi, 8
movzx eax, byte [ebp - 8]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 5]
shl eax, 8
or eax, ecx
dec ebx
mov dword [esi - 4], eax
jne 0x4db960
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0x48]
push eax
push edi
call fcn.004db9fe
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0x448]
push eax
push edi
call fcn.004db9fe
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0x848]
push eax
push edi
call fcn.004db9fe
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0xc48]
push eax
push edi
call fcn.004db9fe
add esp, 0x30
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dbc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call 0x504838
lea eax, [ebp + 8]
push 4
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.004db8ad
add esp, 0xc
test eax, eax
je 0x4dbc6c
mov ax, 1
leave
ret
push esi
push edi
push 8
lea eax, [ebp - 8]
push 1
push eax
call 0x503f38
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp di, 8
jb 0x4dbcb1
lea eax, [ebp - 0x1050]
push esi
push eax
call fcn.004db13d
push 8
lea eax, [ebp - 8]
push esi
push eax
call 0x503bf8
add esp, 0x14
add edi, 0xfff8
add esi, 8
jmp 0x4dbc84
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.004db13d
pop ecx
test di, di
pop ecx
jbe 0x4dbcdb
lea ecx, [ebp - 8]
mov eax, esi
sub ecx, esi
movzx esi, di
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4dbcd2
pop edi
xor ax, ax
pop esi
leave
ret
Function at 0x4dbce2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call 0x504838
lea eax, [ebp + 8]
push 4
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.004db8ad
add esp, 0xc
test eax, eax
je 0x4dbd0e
mov ax, 1
leave
ret
push esi
push edi
push 8
lea eax, [ebp - 8]
push 1
push eax
call 0x503f38
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp di, 8
jb 0x4dbd53
push 8
lea eax, [ebp - 8]
push esi
push eax
call 0x503bf8
lea eax, [ebp - 0x1050]
push esi
push eax
call fcn.004db4f5
add esp, 0x14
add edi, 0xfff8
add esi, 8
jmp 0x4dbd26
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.004db13d
pop ecx
test di, di
pop ecx
jbe 0x4dbd7d
lea ecx, [ebp - 8]
mov eax, esi
sub ecx, esi
movzx esi, di
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4dbd74
pop edi
xor ax, ax
pop esi
leave
ret

Function at 0x4dbdbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
movzx esi, byte [ebp + 0x10]
mov dword [ebp + 0x10], 4
test esi, esi
jle 0x4dbde9
mov ecx, dword [ebp + 0xc]
mov eax, edx
sub ecx, dword [ebp + 8]
mov edi, esi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edi
jne 0x4dbde0
add edx, 8
dec dword [ebp + 0x10]
jne 0x4dbdd2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4dbe9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx edx, byte [ebp + 0xc]
push ebx
push esi
xor esi, esi
push edi
test edx, edx
jle 0x4dbf3b
lea eax, [ebp + esi - 0x28]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 3
sub eax, ecx
pop edi
mov dword [ebp - 8], eax
lea eax, [edi - 2]
push 4
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + edx*8]
mov al, byte [eax + ecx]
push eax
push 3
call fcn.004dbd84
mov ecx, dword [ebp - 4]
mov bl, al
mov eax, dword [ebp - 8]
mov al, byte [eax + ecx]
push eax
push 2
call fcn.004dbd84
add esp, 0x10
xor bl, al
lea eax, [edi - 1]
push 4
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp + 8]
push 4
lea eax, [esi + edx*8]
xor bl, byte [eax + ecx]
mov eax, edi
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + edx*8]
xor bl, byte [eax + ecx]
mov eax, dword [ebp - 4]
add dword [ebp - 4], 8
inc edi
mov byte [eax], bl
lea eax, [edi - 3]
cmp eax, 4
jl 0x4dbec7
movzx edx, byte [ebp + 0xc]
inc esi
cmp esi, edx
jl 0x4dbeb2
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
sub edi, ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], 4
test edx, edx
jle 0x4dbf6b
mov ecx, edx
mov esi, eax
mov ebx, ecx
add edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 8]
add eax, 8
dec dword [ebp + 0xc]
jne 0x4dbf50
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4dc27c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], ebx
xor edi, edi
xor ecx, ecx
lea eax, [ebp + edi - 0x24]
mov dl, byte [esi + ecx]
inc ecx
mov byte [eax], dl
add eax, 8
cmp ecx, 4
jl 0x4dc299
inc edi
add esi, 4
cmp edi, 4
jl 0x4dc293
mov esi, dword [ebp + 0x10]
xor edi, edi
xor ecx, ecx
lea eax, [ebp + edi - 0x44]
mov dl, byte [esi + ecx]
inc ecx
mov byte [eax], dl
add eax, 8
cmp ecx, 4
jl 0x4dc2bb
inc edi
add esi, 4
cmp edi, 4
jl 0x4dc2b5
lea eax, [ebp - 0x224]
mov esi, 0x80
push eax
push esi
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.004dbf78
add esp, 0x10
test ebx, ebx
jle 0x4dc38f
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.004dc19a
add esp, 0x10
cmp ebx, 0x10
jg 0x4dc350
and dword [ebp + 0x14], 0
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x4dc38f
mov ecx, dword [ebp - 4]
sub ecx, ebx
add ecx, dword [ebp + 8]
and dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x14]
push 4
cdq
pop edi
idiv edi
mov eax, dword [ebp + 0x14]
push 4
pop ebx
mov edi, edx
cdq
idiv ebx
lea eax, [ebp + eax - 0x24]
mov al, byte [eax + edi*8]
xor byte [ecx], al
inc ecx
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 0x10]
jl 0x4dc325
jmp 0x4dc387
mov ecx, dword [ebp - 4]
xor esi, esi
sub ecx, ebx
add ecx, dword [ebp + 8]
sub ebx, 0x10
mov dword [ebp + 0xc], ebx
mov eax, esi
push 4
cdq
pop edi
idiv edi
mov eax, esi
push 4
pop ebx
mov edi, edx
cdq
idiv ebx
lea eax, [ebp + eax - 0x24]
mov al, byte [eax + edi*8]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, 0x10
jl 0x4dc360
mov esi, 0x80
mov ebx, dword [ebp + 0xc]
jmp 0x4dc2ec
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e412e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea ecx, [ecx + ecx*4]
push edi
xor eax, eax
push 1
cmp byte [ecx*4 + 0x1005fb28], al
pop ebx
je 0x4e4150
mov byte [esi], 2
mov eax, ebx
mov byte [eax + esi], 0x30
inc eax
xor ecx, ecx
mov byte [eax + esi], 0x31
inc eax
cmp dword [ebp + 0x14], ecx
jle 0x4e4191
mov edx, dword [ebp + 0x10]
lea edi, [ecx + edx]
mov dl, byte [ecx + edx]
xor bl, dl
movzx edx, dl
shr edx, 4
mov dl, byte [edx + 0x10051b4c]
mov byte [eax + esi], dl
mov dl, byte [edi]
and edx, 0xf
inc eax
mov dl, byte [edx + 0x10051b4c]
mov byte [eax + esi], dl
inc eax
inc ecx
cmp ecx, dword [ebp + 0x14]
jl 0x4e4161
movzx ecx, bl
mov edx, ecx
and ecx, 0xf
shr edx, 4
pop edi
mov dl, byte [edx + 0x10051b4c]
mov byte [eax + esi], dl
mov cl, byte [ecx + 0x10051b4c]
inc eax
mov byte [eax + esi], cl
inc eax
mov byte [eax + esi], 3
pop esi
inc eax
pop ebx
pop ebp
ret
Function at 0x4e4e36
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
cmp dword [esp + 0x14], ebx
mov dl, 1
mov byte [ecx], 0x35
push 3
mov byte [ecx + 1], bl
mov byte [ecx + 2], dl
pop esi
jle 0x4e4e76
push edi
mov eax, dword [esp + 0x14]
lea edi, [ebx + eax]
mov al, byte [ebx + eax]
xor dl, al
shr al, 4
mov byte [esi + ecx], al
mov al, byte [edi]
inc esi
and al, 0xf
mov byte [esi + ecx], al
inc esi
inc ebx
cmp ebx, dword [esp + 0x18]
jl 0x4e4e53
pop edi
mov al, dl
and dl, 0xf
shr al, 4
mov byte [esi + ecx], al
inc esi
mov byte [esi + ecx], dl
inc esi
mov byte [esi + ecx], 0x34
inc esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4e4e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x10], esi
mov edi, dword [ebp + 0xc]
jle 0x4e4eaf
mov al, byte [esi + edi]
inc esi
cmp al, 0x35
je 0x4e4eaf
cmp esi, dword [ebp + 0x10]
jl 0x4e4ea2
cmp esi, dword [ebp + 0x10]
jl 0x4e4eb9
or eax, 0xffffffff
jmp 0x4e4f31
mov al, byte [esi + edi]
mov cl, byte [esi + edi + 1]
inc esi
push eax
mov byte [ebp + 0xc], cl
inc esi
call fcn.004e4f36
pop ecx
mov ebx, eax
push dword [ebp + 0xc]
shl bl, 4
call fcn.004e4f36
add bl, al
lea eax, [esi + 1]
cmp eax, dword [ebp + 0x10]
pop ecx
jge 0x4e4f2b
mov ecx, dword [ebp + 8]
add esi, edi
mov dword [ebp + 0xc], ecx
mov cl, byte [esi]
mov dl, byte [esi + 1]
inc esi
inc eax
inc esi
inc eax
push ecx
mov byte [ebp + 8], dl
mov dword [ebp - 8], eax
call fcn.004e4f36
pop ecx
mov edx, eax
push dword [ebp + 8]
shl dl, 4
mov dword [ebp - 4], edx
call fcn.004e4f36
pop ecx
mov ecx, dword [ebp - 4]
add cl, al
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
xor bl, byte [eax]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x4e4eec
neg bl
sbb ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e6348
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov cx, word [eax + 4]
mov bp, word [eax + 2]
mov bx, word [eax + 6]
push esi
push edi
mov di, word [eax]
mov word [esp + 0x1c], cx
lea esi, [edx + 0x12]
mov dword [esp + 0x10], 8
mov ax, word [esi - 0x12]
push eax
push edi
call fcn.004e6458
mov cx, word [esi + 0x24]
add esp, 8
mov edi, eax
push ecx
push ebx
call fcn.004e6458
mov cx, word [esi + 0x12]
mov dx, word [esi]
mov ebx, eax
mov eax, dword [esp + 0x24]
add eax, ecx
add esp, 8
mov dword [esp + 0x1c], eax
add ebp, edx
mov dx, word [esi + 0x36]
xor eax, edi
push eax
push edx
call fcn.004e6458
mov dx, word [esi + 0x48]
mov ecx, ebx
xor ecx, ebp
add esp, 8
add ecx, eax
mov dword [esp + 0x14], eax
push ecx
push edx
call fcn.004e6458
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
add ecx, eax
xor edi, eax
xor ebx, ecx
xor eax, edx
xor ecx, ebp
mov ebp, eax
mov eax, dword [esp + 0x18]
add esp, 8
add esi, 2
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jne 0x4e6376
mov esi, dword [esp + 0x24]
mov dx, word [esi + 0x10]
push edx
push edi
call fcn.004e6458
mov edi, dword [esp + 0x28]
add esp, 8
mov word [edi], ax
mov ax, word [esi + 0x46]
push eax
push ebx
call fcn.004e6458
mov word [edi + 6], ax
mov cx, word [esi + 0x22]
add cx, word [esp + 0x1c]
add esp, 8
mov word [edi + 2], cx
mov dx, word [esi + 0x34]
add dx, bp
mov word [edi + 4], dx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4e9a88
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4e9aa8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
mov dl, byte [ecx]
mov bl, byte [eax]
xor bl, dl
inc ecx
mov byte [eax], bl
inc eax
dec esi
jne 0x4e9a9a
pop ebx
pop esi
ret
Function at 0x4ea508
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
lea eax, [esp + 8]
push ebx
push esi
push edi
push ebp
push 0x22
push eax
call fcn.004ea498
mov dx, 8
add esp, 8
movzx eax, dx
dec dx
mov ecx, dword [esp + 0x40]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
sub dword [eax], ebx
cmp dx, 2
jae 0x4ea522
mov si, 8
xor edi, edi
mov word [esp + 0x12], di
mov ebx, 0x80000000
mov eax, dword [esp + 0x12]
and eax, 0xffff
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
mov ecx, eax
and ecx, ebx
cmp ecx, 1
sbb dl, dl
xor cx, cx
inc dl
mov ebp, ebx
and ebp, eax
je 0x4ea572
test dl, dl
je 0x4ea585
test ebp, ebp
jne 0x4ea57a
test dl, dl
jne 0x4ea585
shr ebx, 1
inc cx
cmp cx, 0x20
jb 0x4ea568
shr cx, 2
mov bl, 7
sub bl, cl
movzx cx, bl
lea edx, [edx + ebx*2]
lea ecx, [ecx*4 + 4]
mov word [esp + 0x14], cx
mov byte [esp + 0x11], dl
xor dx, dx
mov bl, byte [esp + 0x11]
mov cl, 3
movzx ebp, di
sub cl, dl
shr bl, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x4ea5ca
mov si, 8
inc di
inc dx
cmp dx, 4
jb 0x4ea5a7
xor dx, dx
cmp word [esp + 0x14], dx
je 0x4ea60a
mov ebx, eax
mov cl, byte [esp + 0x14]
movzx ebp, di
sub cl, dl
dec cl
shr ebx, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x4ea601
mov si, 8
inc di
inc dx
cmp dx, word [esp + 0x14]
jb 0x4ea5dc
inc word [esp + 0x12]
cmp word [esp + 0x12], 9
jb 0x4ea545
cmp si, 8
je 0x4ea623
inc di
call dword [0x100450dc]
mov esi, dword [esp + 0x44]
push 0x28
mov dword [esp + 0x18], eax
push esi
call fcn.004ea498
mov al, byte [esp + 0x1c]
add esp, 8
movzx ecx, di
mov edi, 0x26
mov byte [esi], al
xor eax, eax
sub edi, ecx
mov al, byte [esp + 0x15]
cdq
idiv edi
add dl, 2
mov al, byte [esp + 0x14]
sub al, dl
movzx bx, dl
movzx edx, bx
mov byte [esi + 1], al
lea edi, [ecx + edx]
cmp edi, edx
jle 0x4ea67f
movzx eax, bx
inc bx
mov byte [eax + esi], 1
movzx ebp, bx
cmp ebp, edi
jl 0x4ea66f
mov bx, 2
movzx eax, bx
lea edi, [eax + esi]
cmp byte [edi], 0
jne 0x4ea694
mov al, byte [esp + 0x16]
mov byte [edi], al
inc bx
cmp bx, 0x28
jb 0x4ea683
lea eax, [esp + 0x18]
push ecx
push eax
add edx, esi
push edx
call fcn.004ea4b8
mov cx, 1
add esp, 0xc
movzx eax, cx
inc cx
add eax, esi
mov dl, byte [eax - 1]
xor byte [eax], dl
cmp cx, 0x28
jb 0x4ea6b1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret