joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bef0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x8005
push edi
call fcn.004bf0ac
add esp, 8
xor eax, eax
cmp eax, dword [ebp + 0x10]
jae 0x4bef4f
movzx edx, bx
sar edx, 8
xor ecx, ecx
mov cl, byte [esi]
inc esi
xor edx, ecx
inc eax
shl ebx, 8
mov dx, word [edi + edx*4 + 0x30]
xor dx, bx
cmp eax, dword [ebp + 0x10]
mov ebx, edx
jb 0x4bef2f
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bef58
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4bef93
mov eax, dword [ebp + 0x14]
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.0054bd38
add esp, 0xc
xor eax, eax
jmp 0x4bf0a3
push ebx
call fcn.0054b378
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0x580090
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x4befdb
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0054bcc8
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push 0x5800a9
push ecx
call fcn.0054f4a8
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x4bf09a
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, 0x5800b2
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0054bddc
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0054bddc
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4bf08d
cmp dword [ebp - 8], 0x32
jae 0x4bf08d
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0054bcc8
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x4bf006
push edi
call fcn.0054b1b0
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d648c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d73c4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x58b900
push ebx
push esi
mov esi, dword [ebp + 0xc]
call fcn.0054c16c
mov dword [ebp - 0x158], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d7449
mov word [ebp - 0x20], 8
mov edx, str.error1
lea eax, [ebp - 4]
call fcn.00559dd8
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0055a0b8
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.0055a088
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4d7518
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4d74c4
cmp esi, dword [ebp - 0x150]
jne 0x4d74b3
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x134]
lea eax, [ebp - 8]
call fcn.00559dd8
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.0055a0b8
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.0055a088
pop eax
mov word [ebp - 0x20], 0x20
and byte [eax], al
lea ecx, [ebp - 0x158]
push ecx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4d745a
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x20], 0x38
mov edx, 0x58b76f
mov bh, 0x58
add byte [ebp - 0x4170bbb], cl
sub byte [eax], cl
add bh, bh
inc ebp
in al, dx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8ba4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jne 0x4d8bcf
xor eax, eax
jmp 0x4d8cdf
lea edx, [ebp - 0x104]
push edx
push ebx
call fcn.004d8ce8
mov ecx, dword [ebp + 0xc]
add esp, 8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x30c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x30c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0054be6c
pop ecx
dec eax
lea edx, [ebp + eax - 0x30c]
test eax, eax
jle 0x4d8c2e
movsx ecx, byte [edx]
cmp ecx, 0x5c
je 0x4d8c2e
dec eax
dec edx
test eax, eax
jg 0x4d8c20
mov byte [ebp + eax - 0x30c], 0
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.0054bf65
add esp, 8
lea ecx, [ebp - 0x30c]
cmp eax, ecx
jne 0x4d8c5d
mov al, 1
jmp 0x4d8cdf
lea edi, [ebp - 0x208]
mov esi, 0x58c2d7
mov eax, edi
lea edx, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0x208]
push ecx
call fcn.0054bddc
add esp, 8
lea eax, [ebp - 0x30c]
lea edx, [ebp - 0x208]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d8cb0
test cl, cl
je 0x4d8caa
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d8cb0
add eax, 2
add edx, 2
test cl, cl
jne 0x4d8c8e
jne 0x4d8cb0
mov al, 1
jmp 0x4d8cdf
lea eax, [ebp - 0x30c]
mov edx, str._systemroot_system32
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4d8cdd
test cl, cl
je 0x4d8cd7
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4d8cdd
add eax, 2
add edx, 2
test cl, cl
jne 0x4d8cbb
jne 0x4d8cdd
mov al, 1
jmp 0x4d8cdf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8d1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x58c034
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d8ba4
add esp, 8
test al, al
jne 0x4d8d55
xor eax, eax
jmp 0x4d8df0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054be6c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d8d7b
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d8d7b
dec ebx
dec eax
test ebx, ebx
jg 0x4d8d6d
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054bcc8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d8db8
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d8dac
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054bf6c
add esp, 0xc
test eax, eax
je 0x4d8de5
inc ebx
cmp ebx, 7
jl 0x4d8dba
cmp ebx, 7
jge 0x4d8dee
mov al, 1
jmp 0x4d8df0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d8df8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ecx, 0x23
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
mov eax, dword [ebp + 8]
mov esi, 0x58c0c0
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
push eax
call fcn.004d8ba4
add esp, 8
test al, al
jne 0x4d8e31
xor eax, eax
jmp 0x4d8ecc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054be6c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d8e57
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d8e57
dec ebx
dec eax
test ebx, ebx
jg 0x4d8e49
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054bcc8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
cld
invalid
invalid
inc dword [eax]
lea eax, [ebp - 0x104]
jle 0x4d8e94
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d8e88
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x190]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054bf6c
add esp, 0xc
test eax, eax
je 0x4d8ec1
inc ebx
cmp ebx, 4
jl 0x4d8e96
cmp ebx, 4
jge 0x4d8eca
mov al, 1
jmp 0x4d8ecc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8ed4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov esi, 0x58c14c
lea edi, [ebp - 0x118]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054be6c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d8f18
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d8f18
dec ebx
dec eax
test ebx, ebx
jg 0x4d8f0a
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054bcc8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d8f55
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d8f49
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x118]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054bf6c
add esp, 0xc
test eax, eax
je 0x4d8f82
inc ebx
cmp ebx, 1
jl 0x4d8f57
dec ebx
jge 0x4d8f89
mov al, 1
jmp 0x4d8f8b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8f94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4d8fb5
xor eax, eax
jmp 0x4d90c5
push ebx
call fcn.0054b378
pop ecx
mov edi, eax
push edi
push ebx
push 0
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.DLL_VerQueryValueA
cmp dword [ebp - 8], 4
jb 0x4d8ffd
push 4
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.0054bcc8
add esp, 0xc
movzx eax, word [ebp - 0xa]
push eax
lea ecx, [ebp - 0x40]
movzx edx, word [ebp - 0xc]
push edx
push str._04X_04X
push ecx
call fcn.0054f4a8
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, eax
cmp ebx, dword [ebp + 0x14]
jge 0x4d90bc
xor eax, eax
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
lea edi, [ebp - 0x74]
mov esi, str.StringFileInfo_
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
push edx
push ecx
call fcn.0054bddc
add esp, 8
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
add eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x74]
push edx
call fcn.0054bddc
add esp, 8
mov byte [esi], 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4d90af
cmp dword [ebp - 8], 0x32
jae 0x4d90af
mov edx, ebx
mov ecx, dword [ebp - 8]
add edx, edx
push ecx
mov eax, dword [ebp - 4]
push eax
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, dword [ebp + 0x10]
push edx
call fcn.0054bcc8
add esp, 0xc
inc ebx
add esi, 0x32
cmp ebx, dword [ebp + 0x14]
jl 0x4d9028
push edi
call fcn.0054b1b0
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d90cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov esi, 0x58c160
lea edi, [ebp - 0x154]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, 0x58c1b0
lea edi, [ebp - 0x1b8]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004d8ba4
add esp, 8
test al, al
jne 0x4d9117
xor eax, eax
jmp 0x4d9205
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054be6c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d913d
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d913d
dec ebx
dec eax
test ebx, ebx
jg 0x4d912f
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054bcc8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d917a
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d916e
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x154]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054bf6c
add esp, 0xc
test eax, eax
je 0x4d91a7
inc ebx
cmp ebx, 4
jl 0x4d917c
cmp ebx, 4
jge 0x4d9203
push 2
lea eax, [ebp - 0x1b8]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d8f94
add esp, 0x10
test al, al
jne 0x4d91cd
xor eax, eax
jmp 0x4d9205
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x4d
jne 0x4d91e8
cmp byte [eax + 2], 0x63
jne 0x4d91e8
cmp byte [eax + 4], 0x6f
jne 0x4d91e8
mov al, 1
jmp 0x4d9205
lea eax, [ebp - 0x1b8]
cmp byte [eax], 0x57
jne 0x4d9203
cmp byte [eax + 1], 0x69
jne 0x4d9203
cmp byte [eax + 2], 0x6e
jne 0x4d9203
mov al, 1
jmp 0x4d9205
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
mov esi, 0x58c214
lea edi, [ebp - 0x118]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov esi, 0x58c228
lea edi, [ebp - 0x17c]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004d8ba4
add esp, 8
test al, al
jne 0x4d936b
xor eax, eax
jmp 0x4d9457
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054be6c
pop ecx
mov esi, eax
lea ebx, [esi - 1]
mov eax, dword [ebp + 0xc]
add eax, ebx
test ebx, ebx
jle 0x4d9391
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4d9391
dec ebx
dec eax
test ebx, ebx
jg 0x4d9383
inc ebx
mov edi, esi
sub edi, ebx
push edi
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.0054bcc8
sub esi, ebx
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov byte [ebp + edi - 0x104], 0
lea eax, [ebp - 0x104]
jle 0x4d93ce
mov dl, 0x64
sub dl, bl
inc ebx
xor byte [eax], dl
inc eax
cmp esi, ebx
jg 0x4d93c2
xor ebx, ebx
mov edx, ebx
push esi
shl edx, 2
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x118]
push eax
lea edx, [edx + edx*4]
add edx, ecx
push edx
call fcn.0054bf6c
add esp, 0xc
test eax, eax
je 0x4d93fb
inc ebx
cmp ebx, 1
jl 0x4d93d0
dec ebx
jge 0x4d9455
push 2
lea eax, [ebp - 0x17c]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d8f94
add esp, 0x10
test al, al
jne 0x4d941f
xor eax, eax
jmp 0x4d9457
lea eax, [ebp - 0x17c]
cmp byte [eax], 0x4d
jne 0x4d943a
cmp byte [eax + 2], 0x63
jne 0x4d943a
cmp byte [eax + 4], 0x6f
jne 0x4d943a
mov al, 1
jmp 0x4d9457
lea eax, [ebp - 0x17c]
cmp byte [eax], 0x57
jne 0x4d9455
cmp byte [eax + 1], 0x69
jne 0x4d9455
cmp byte [eax + 2], 0x6e
jne 0x4d9455
mov al, 1
jmp 0x4d9457
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4db994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
cmp byte [esi], 0xa0
jb 0x4db9ae
cmp byte [esi + 1], 0xa0
jae 0x4db9b9
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
jmp 0x4dbb60
mov eax, ebx
call fcn.005087d0
cmp al, 5
jne 0x4dbb60
mov eax, ebx
mov dword [ebp - 0x20], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x20]
add eax, 3
test eax, eax
jns 0x4db9e3
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x24], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
dec edx
call fcn.00508854
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x4dbb60
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jge 0x4dbb60
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dbb60
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x4dbb60
push 2
push esi
lea eax, [ebp - 6]
push eax
call fcn.0054bcc8
add byte [ebp - 6], 0x60
add byte [ebp - 5], 0x60
xor edx, edx
xor eax, eax
mov dl, byte [ebp - 6]
mov al, byte [ebp - 5]
add esp, 0xc
lea ecx, [edx + edx*2]
shl ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, eax
mov eax, ecx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xfffff718
test eax, eax
jb 0x4dba8d
cmp eax, 0x2feb0
jb 0x4dba98
mov edx, dword [ebp + 0x10]
add dword [edx], 0xc
jmp 0x4dbb60
push 0x18
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0054bcc8
add esp, 0xc
lea edx, [ebp - 0x40]
xor eax, eax
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0x18
jl 0x4dbab1
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004db95c
pop ecx
xor edx, edx
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dbb4c
cmp eax, dword [ebp - 0x18]
jge 0x4dbb4c
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x20]
mov bx, word [eax]
mov cx, 1
mov eax, ebx
movzx ebx, bx
sar ebx, 8
shl eax, 8
or ax, bx
mov ebx, eax
mov eax, dword [ebp - 0x18]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x24]
add eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
xor eax, eax
mov esi, 0xf
sub esi, eax
add esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x1c]
jge 0x4dbb44
cmp eax, 4
jl 0x4dbb44
test cx, bx
jbe 0x4dbb44
mov esi, 0xf
sub esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*2]
mov si, word [ebp - 0xe]
mov word [edi], si
add ecx, ecx
inc eax
cmp eax, 0x10
jl 0x4dbb17
inc edx
add dword [ebp - 0x28], 2
cmp edx, 0xc
jl 0x4dbad1
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dbb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
cmp bl, 0x20
jb 0x4dbb81
cmp bl, 0x7f
jb 0x4dbb8c
mov eax, dword [ebp + 0x10]
add dword [eax], 6
jmp 0x4dbcef
mov eax, esi
call fcn.005087d0
cmp al, 5
jne 0x4dbcef
mov eax, esi
mov dword [ebp - 0x1c], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x1c]
add eax, 3
test eax, eax
jns 0x4dbbb6
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x20], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, esi
dec edx
call fcn.00508854
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff4
jle 0x4dbcef
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jge 0x4dbcef
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dbcef
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x14]
jge 0x4dbcef
xor eax, eax

Function at 0x4dbe54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.004dbde0
mov eax, dword [ebp + 8]
add eax, esi
jmp 0x4dbe8c
mov edx, ebx
shr edx, 0x18
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov edx, dword [ecx*4 + 0x5a65c0]
mov cl, byte [eax]
shl ebx, 8
and ecx, 0xff
or ebx, ecx
xor ebx, edx
inc eax
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x4dbe69
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4e1dc0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx + 0x104], edi
test edi, edi
jne 0x4e1ded
push 0x3e8
call sub.KERNEL32.DLL_Sleep
inc esi
cmp esi, 5
jl 0x4e1dcb
cmp esi, 5
jl 0x4e1dfa
or eax, 0xffffffff
jmp 0x4e1ee1
push str.Create
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59613c], eax
push str.Start
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x596140], eax
push str.Stop
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x596144], eax
push str.Addbuffer
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59614c], eax
push str.Getnowtimehm
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x596148], eax
push str.Setylvalue
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x596150], esi
cmp dword [0x59613c], 0
jne 0x4e1e91
mov eax, 0xfffffffe
jmp 0x4e1ee1
cmp dword [0x596140], 0
jne 0x4e1ea1
mov eax, 0xfffffffd
jmp 0x4e1ee1
cmp dword [0x596144], 0
jne 0x4e1eb1
mov eax, 0xfffffffc
jmp 0x4e1ee1
cmp dword [0x59614c], 0
jne 0x4e1ec1
mov eax, 0xfffffffb
jmp 0x4e1ee1
cmp dword [0x596148], 0
jne 0x4e1ed1
mov eax, 0xfffffffa
jmp 0x4e1ee1
test esi, esi
jne 0x4e1edc
mov eax, 0xfffffff9
jmp 0x4e1ee1
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e2560
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx + 0x104], edi
test edi, edi
jne 0x4e258d
push 0x3e8
call sub.KERNEL32.DLL_Sleep
inc esi
cmp esi, 5
jl 0x4e256b
cmp esi, 5
jl 0x4e259a
or eax, 0xffffffff
jmp 0x4e26a7
push str.NeAACDecOpen
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962d4], eax
push str.NeAACDecInit2
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962d8], eax
push str.NeAACDecClose
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962dc], eax
push str.NeAACDecAudioSpecificConfig
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962e0], eax
push str.NeAACDecDecode
mov ecx, dword [ebx + 0x104]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962e4], eax
push str.NeAACDecGetCurrentConfiguration
mov eax, dword [ebx + 0x104]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5962e8], eax
push str.NeAACDecSetConfiguration
mov edx, dword [ebx + 0x104]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x5962ec], esi
cmp dword [0x5962d4], 0
jne 0x4e2647
mov eax, 0xfffffffe
jmp 0x4e26a7
cmp dword [0x5962d8], 0
jne 0x4e2657
mov eax, 0xfffffffd
jmp 0x4e26a7
cmp dword [0x5962dc], 0
jne 0x4e2667
mov eax, 0xfffffffc
jmp 0x4e26a7
cmp dword [0x5962e0], 0
jne 0x4e2677
mov eax, 0xfffffffb
jmp 0x4e26a7
cmp dword [0x5962e4], 0
jne 0x4e2687
mov eax, 0xfffffffa
jmp 0x4e26a7
cmp dword [0x5962e8], 0
jne 0x4e2697
mov eax, 0xfffffff9
jmp 0x4e26a7
test esi, esi
jne 0x4e26a2
mov eax, 0xfffffff8
jmp 0x4e26a7
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret