joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4177d5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4177e0
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x41789b
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
sub edi, 8
dec esi
jne 0x417800
pop ebx
test edi, edi
je 0x4178b4
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x461720]
inc edx
dec edi
jne 0x41789f
pop edi
not eax
pop esi
ret

Function at 0x417d4b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x417d7f
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x417d7a
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x417da7
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x417d90
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00449e70
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x418b44
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x476110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x418bee
movzx ecx, word [esi]
test cx, cx
je 0x418bee
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x418b82
cmp cx, 0x5c
jne 0x418b84
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x418b76
cmp eax, esi
je 0x418bc2
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044ad7f
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00418b44
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0044a3b8
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0044a38a
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004468f0
leave
ret
Function at 0x41a11f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x41a19a
cmp dword [esi + 4], 0xffffffff
jne 0x41a19a
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x46b464
push edi
call fcn.0044a38a
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x41a16c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x41a16c
mov eax, 0x2000000
jmp 0x41a19f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417b61
add esp, 0x10
test eax, eax
jne 0x41a18a
mov eax, dword [ebp + 0x10]
jmp 0x41a19f
push eax
call fcn.00419d1b
mov dword [esi], eax
mov eax, dword [0x477cc0]
pop ecx
jmp 0x41a19f
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x41b0fc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x476110]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x45b97f
call fcn.0044861d
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0041a6bf
call fcn.0040e52f
push eax
lea ecx, [ebp + 0x230]
call fcn.00412cde
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0040e535
mov ecx, eax
call fcn.00412a3a
test al, al
je 0x41b25e
push edi
lea ecx, [ebp + 0x230]
call fcn.00412acd
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp + 0x230]
call fcn.00412a65
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x41b1d2
push str.Error_opening_file
mov ecx, ebx
call fcn.0041a8bb
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.00412915
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004468f0
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x41b1e7
push esi
push str.File_is_empty
jmp 0x41b193
cmp edi, 0x400000
jbe 0x41b1f7
push esi
push 0x461f9c
jmp 0x41b193
push edi
mov dword [ebp - 0x14], esi
call fcn.0040e19b
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x41b23d
push dword [ebp - 0x10]
call fcn.00446d8c
pop ecx
mov ecx, ebx
call fcn.0041a6bf
push esi
push str.Could_not_read_file
jmp 0x41b193
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.0041afab
push dword [ebp - 0x10]
mov bl, al
call fcn.00446d8c
pop ecx
jmp 0x41b19c
call fcn.0040e535
push eax
lea ecx, [ebp + 0x230]
call fcn.00412ab3
call fcn.0040e53b
test al, al
je 0x41b27f
call fcn.0040e541
jmp 0x41b296
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.00412a65
push eax
call fcn.0041a4fe
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x41b2a8
push esi
push str.Error_opening_zip_file
jmp 0x41b193
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.00418bfc
add esp, 0x14
test eax, eax
je 0x41b2cd
push esi
push str.Could_not_find_ziped_file
jmp 0x41b193
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x41b1df
cmp eax, 0x400000
ja 0x41b1ef
push eax
call fcn.0040e19b
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.0041a55b
add esp, 0x18
cmp eax, esi
je 0x41b334
cmp eax, 0x600
je 0x41b334
push edi
call fcn.00446d8c
pop ecx
call fcn.0040e53b
test al, al
jne 0x41b329
push dword [ebp - 0x10]
call fcn.0041a595
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x41b193
call fcn.0040e53b
test al, al
jne 0x41b346
push dword [ebp - 0x10]
call fcn.0041a595
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.0041afab
push edi
jmp 0x41b251
Function at 0x42507e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x4f8], ebx
je 0x4250f3
cmp dword [ebp + 8], 0x100
jne 0x4250e1
cmp word [ebp + 0xc], 0xd
jne 0x4250e1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jle 0x4250b7
cmp byte [esi + 0x4fe], bl
je 0x4250c8
push 0x11
call edi
test ax, ax
jge 0x4250e1
cmp byte [esi + 0x4ff], bl
jne 0x4250e1
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4250dd
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.004102df
xor eax, eax
jmp 0x4250f6
mov eax, dword [esi + 0x4f8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop edi
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x42c651
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x42c676
cmp eax, edi
jge 0x42c66e
mov eax, esi
call fcn.0042c005
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x42c698
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x42c67d
cmp ecx, 4
jge 0x42c6b7
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x42c6a5
xor eax, eax
jmp 0x42c6ad
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x42c69b
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x42c6e9
mov eax, str.zlib_corrupt
call fcn.00429c22
jmp 0x42c724
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x42c6f9
mov eax, str.read_past_buffer
jmp 0x42c6e2
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x42c70e
mov ecx, edi
call fcn.0042c030
test eax, eax
je 0x42c724
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00449e70
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x440bec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x476110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x28], bl
je 0x440c5d
cmp dword [esi + 0x20], ebx
je 0x440c5d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.0044a780
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x440c5d
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x20]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.00412a91
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004102df
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004468f0
leave
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403203
pop dword [ebp - 0x4c]
mov eax, 0xa36e3d11
sub eax, 0xa32e0b0e
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xee4076a7
sub dword [ebp - 0x5c], 0x9fee315c
mov dword [ebp - 0x58], 0x41de9052
add dword [ebp - 0x58], 0xf054bbf3
mov dword [ebp - 0x54], 0xbbc0148
add dword [ebp - 0x54], 0x409042e6
mov dword [ebp - 0x50], 0x21abb49a
add dword [ebp - 0x50], 0xde544b66
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xaa62aafc
sub dword [ebp - 0x5c], 0x35f041a6
mov dword [ebp - 0x58], 0xd13970f2
sub dword [ebp - 0x58], 0x8fcd0f7d
mov dword [ebp - 0x54], 0xb221e4a9
sub dword [ebp - 0x54], 0x4eb2783d
mov dword [ebp - 0x50], 0x1ab80df0
add dword [ebp - 0x50], 0xe547f210
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xe14a8998
add eax, 0x1ef5f73c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ca15
push 0
call eax
mov ecx, 0xc60c3937
sub ecx, 0xc60bd912
mov edi, eax
mov ebx, 0x58637cd
sub ebx, 0x54527cd
add ebx, dword [ebp - 0x4c]
mov esi, 0xc47a824b
sub esi, 0x7774a860
sub dword [ebp - 0x34], 0x8e4dc0b
mov edx, dword [ebx]
sub dword [ebp - 0x10], esi
xor edx, esi
xor dword [ebp - 0x24], 0x1ff77714
mov dword [edi], edx
sub dword [ebp - 8], ebx
add edi, 0xafdc6434
add edi, 0x50239bd0
add ebx, 4
loop 0x403320
add eax, 0x4ebbb62a
add eax, 0xb145bd3d
mov ebx, eax
add eax, 5
mov ecx, 0x1bb49c29
add ecx, 0xe48b63d7
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4a6446
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
shr eax, 1
mov edx, dword [ebp - 8]
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0x4a645c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ecx*4 + 0x496644], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jb 0x4a6451
mov esp, ebp
pop ebp
ret

Function at 0x4a649b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jbe 0x4a64d9
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [edx]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov eax, dword [ecx*4 + 0x496644]
mov edx, dword [ebp + 8]
shr edx, 8
xor eax, edx
mov dword [ebp + 8], eax
dec dword [ebp + 0x10]
inc dword [ebp - 4]
cmp dword [ebp + 0x10], 0
ja 0x4a64ab
mov eax, dword [ebp + 8]
pop ecx
pop ebp
ret
Function at 0x4acdae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [0x48fba8], 0
je 0x4acf27
xor eax, eax
mov dword [0x48fba8], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + 0x48fbac]
mov ecx, 0x1f
sub ecx, edx
mov eax, 1
shl eax, cl
or dword [ebp - 0x10], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jl 0x4acdd2
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4ace17
mov edx, dword [ebp - 4]
shr edx, 1
xor edx, dword [ebp - 0x10]
jmp 0x4ace1c
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0x4ace07
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x496a44], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jl 0x4acdfc
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x496a44]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
mov edx, dword [ebp - 4]
shr edx, 8
and edx, 0xff00
add eax, edx
mov ecx, dword [ebp - 4]
and ecx, 0xff00
shl ecx, 8
add eax, ecx
mov edx, dword [ebp - 4]
and edx, 0xff
shl edx, 0x18
add eax, edx
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x497a44], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x496a44]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 0xa
lea eax, [ecx + 0x496a44]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
mov edx, dword [ebp - 4]
shr edx, 8
and edx, 0xff00
add eax, edx
mov ecx, dword [ebp - 4]
and ecx, 0xff00
shl ecx, 8
add eax, ecx
mov edx, dword [ebp - 4]
and edx, 0xff
shl edx, 0x18
add eax, edx
mov ecx, dword [ebp - 0xc]
shl ecx, 0xa
lea edx, [ecx + 0x497a44]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4ace94
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jl 0x4ace46
xor eax, eax
mov dword [0x48fba4], eax
jmp 0x4acf30
cmp dword [0x48fba4], 0
jne 0x4acf27
mov esp, ebp
pop ebp
ret
Function at 0x4e8dfe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4e8e04
ret
Function at 0x552af3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x10148050]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x90
push eax
mov dword [0x10155fac], eax
mov dword [0x10155fb0], eax
mov dword [0x10155fb4], eax
mov dword [0x10155fb8], eax
mov dword [0x10155fbc], eax
mov dword [0x10155fc0], eax
mov dword [0x10155fc4], eax
mov dword [0x10155fc8], eax
lea eax, [ebp - 0x494]
push eax
call fcn.005778d3
add esp, 0xc
lea ecx, [ebp - 0x498]
push ecx
mov dword [ebp - 0x498], 0x94
call dword [0x1010208c]
cmp dword [ebp - 0x488], 2
jne 0x552bd1
lea edx, [ebp - 0x49c]
push edx
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x49c], 0
call fcn.00552873
add esp, 4
test eax, eax
jne 0x552b9b
push ebx
lea ebx, [ebp - 0x49c]
lea ecx, [ebp - 0x404]
call fcn.00552633
pop ebx
push esi
mov esi, dword [ebp - 0x49c]
xor eax, eax
test esi, esi
je 0x552bd0
jmp 0x552bb3
mov dl, byte [ebp + eax - 0x404]
mov ecx, eax
and ecx, 0x1f
xor byte [ecx + 0x10155fac], dl
lea ecx, [ecx + 0x10155fac]
inc eax
cmp eax, esi
jb 0x552bb3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057371d
mov esp, ebp
pop ebp
ret

Function at 0x552ca3
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x10148050]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x74]
push edx
mov dword [ebp - 0xd0], eax
call fcn.005738f9
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x64]
push edx
mov edx, dword [ebp - 0x60]
push eax
push ecx
push edx
push 0x1013fab4
lea eax, [ebp - 0x40]
push 0x38
push eax
call fcn.005738db
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x28], eax
mov eax, dword [0x10155f84]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x10155f80]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10155f90]
mov dword [ebp - 0x30], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x20], edx
mov edx, dword [0x10155f8c]
mov dword [ebp - 0x10], eax
xor eax, eax
add esp, 0x2c
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x10155f88]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x10155f94]
push eax
mov eax, 0x38
lea esi, [ebp - 0xcc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc4], 0x67452301
mov dword [ebp - 0xc0], 0xefcdab89
mov dword [ebp - 0xbc], 0x98badcfe
mov dword [ebp - 0xb8], 0x10325476
call fcn.0055cdd3
lea edi, [ebp - 0x50]
mov ecx, esi
mov ebx, edi
call fcn.0055ce83
mov ecx, dword [ebp - 0x48]
xor ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xd0]
xor edx, dword [ebp - 0x4c]
pop edi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057371d
mov esp, ebp
pop ebp
ret
Function at 0x552de3
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0x10148050]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x64
mov esi, edx
lea edx, [ebp - 0x184]
push edx
push 0xffffffffffffffff
push esi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], ecx
call dword [0x10102090]
test eax, eax
jne 0x552e4e
call dword [0x10102094]
push esi
lea eax, [ebp - 0x74]
push 0x64
push eax
call fcn.00573fa5
lea eax, [ebp - 0x74]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x552e43
sub eax, edx
jmp 0x552e90
push ebx
push ebx
push 0x64
lea ecx, [ebp - 0x74]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x184]
push edx
push ebx
push 0xfde9
call dword [0x10102098]
cmp eax, ebx
jne 0x552e8f
push esi
lea eax, [ebp - 0x74]
push 0x64
push eax
call fcn.00573fa5
lea eax, [ebp - 0x74]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x552e84
sub eax, edx
jmp 0x552e90
dec eax
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1e4], 0x67452301
mov dword [ebp - 0x1e0], 0xefcdab89
mov dword [ebp - 0x1dc], 0x98badcfe
mov dword [ebp - 0x1d8], 0x10325476
cmp eax, ebx
je 0x552ef6
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x194]
push edx
lea esi, [ebp - 0x1ec]
call fcn.0055cdd3
lea edi, [ebp - 0x194]
lea ecx, [ebp - 0x1ec]
mov ebx, edi
call fcn.0055ce83
mov eax, edi
push eax
lea ebx, [ebp - 0xbc]
call fcn.0055cf83
mov esi, dword [ebp - 0x1f4]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x552f23
sub eax, edx
mov ecx, 0
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e4], 0x67452301
mov dword [ebp - 0x1e0], 0xefcdab89
mov dword [ebp - 0x1dc], 0x98badcfe
mov dword [ebp - 0x1d8], 0x10325476
je 0x552f7a
push esi
lea ecx, [ebp - 0x194]
push ecx
lea esi, [ebp - 0x1ec]
call fcn.0055cdd3
lea edi, [ebp - 0x194]
lea ecx, [ebp - 0x1ec]
mov ebx, edi
call fcn.0055ce83
mov edx, edi
push edx
lea ebx, [ebp - 0x9c]
call fcn.0055cf83
xor eax, eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0xbc]
push eax
mov ecx, edi
push ecx
mov eax, 0x40
lea esi, [ebp - 0x1ec]
mov dword [ebp - 0x1e4], 0x67452301
mov dword [ebp - 0x1e0], 0xefcdab89
mov dword [ebp - 0x1dc], 0x98badcfe
mov dword [ebp - 0x1d8], 0x10325476
call fcn.0055cdd3
mov ecx, esi
mov ebx, edi
call fcn.0055ce83
mov eax, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x190]
mov dword [eax], edx
mov edx, dword [ebp - 0x18c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x188]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057371d
mov esp, ebp
pop ebp
ret