joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0ba0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call fcn.004fa6bf
mov edi, eax
add esp, 8
test edi, edi
jne 0x4c0c33
push 0x7c
push 0x516fa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004aa7a0
push 0x516fc8
push esi
push 0x516fc4
push ebx
push 0x516fbc
push 5
call fcn.004aa900
add esp, 0x2c
call fcn.004fad8f
cmp dword [eax], 2
jne 0x4c0c15
push 0x7f
push 0x516fa4
push 0x80
push 0x6d
push 0x20
call fcn.004aa7a0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x81
push 0x516fa4
push 2
push 0x6d
push 0x20
call fcn.004aa7a0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x53f0fc
call fcn.004a7ea0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c0c55
push edi
call fcn.004f9f21
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004a7a50
push edi
push 1
push 0x6a
push esi
call fcn.004a7d60
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4c15d0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4c16b3
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x4c164d
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x53f128]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x53f128]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x53f128]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + 0x53f128]
mov byte [ecx + 3], dl
jmp 0x4c169e
shl edx, 0x10
cmp edi, 2
jne 0x4c165d
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x53f128]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x53f128]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x4c168a
lea edx, [edi + 0x3c]
jmp 0x4c1697
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x53f128]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x4c15f0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x4d3110
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe4
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf0]
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
mov edi, dword [esp + 0xf8]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.004e7220
mov esi, dword [esp + 0x110]
add esp, 4
mov dword [esp + 0x18], esi
test edi, edi
jne 0x4d3173
mov dword [esp + 0xfc], edi
jmp 0x4d3192
cmp dword [esp + 0xfc], 0xffffffff
jne 0x4d3192
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3182
sub eax, edx
mov dword [esp + 0xfc], eax
test esi, esi
je 0x4d32af
jmp 0x4d31a4
mov esi, dword [esp + 0x18]
cmp esi, 0x14
jle 0x4d31ae
mov esi, 0x14
mov eax, ebx
mov ecx, ebx
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
push 0
mov byte [esp + 0x18], al
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], bl
call fcn.004b84c0
push eax
mov eax, dword [esp + 0x104]
push eax
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.004e6fd0
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004e7190
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.004e7190
push 0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.004e71a0
push esi
lea eax, [esp + 0x118]
push eax
push ebp
call fcn.004f8b20
mov eax, dword [esp + 0x14c]
add esp, 0x44
cmp eax, 1
jle 0x4d329a
dec eax
mov dword [esp + 0x10], eax
jmp 0x4d3250
mov eax, dword [esp + 0xfc]
push 0
lea ecx, [esp + 0xe0]
push ecx
push 0x14
mov edx, ecx
push edx
push eax
push edi
call fcn.004b84c0
push eax
call fcn.004e7290
add esp, 0x1c
test esi, esi
jle 0x4d3294
lea ecx, [esp + 0xdc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x4d3287
mov edi, dword [esp + 0x20]
dec dword [esp + 0x10]
jne 0x4d3250
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4d31a0
lea eax, [esp + 0x24]
push eax
call fcn.004e7250
mov ecx, dword [esp + 0xf4]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004f7824
add esp, 0xe4
ret
Function at 0x4d46e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.004d41b0
add esp, 0xc
test eax, eax
js 0x4d4928
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4d475d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4d4720
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4d4924
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x5232b8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5232b8]
and esi, 0xff
mov esi, dword [esi*4 + 0x523eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5246b8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5232b8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x524ab8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x5232b8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5242b8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x5232b8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5232b8]
and esi, 0xff
mov esi, dword [esi*4 + 0x523eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5246b8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x5232b8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5242b8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5232b8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x524ab8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x5232b8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5232b8]
and esi, 0xff
mov esi, dword [esi*4 + 0x523eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5246b8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x5232b8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5242b8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5232b8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x524ab8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x5232b8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5232b8]
and esi, 0xff
mov esi, dword [esi*4 + 0x523eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5246b8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x5232b8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5232b8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5242b8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x524ab8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x4d4771
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x4d65c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ebx
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0xc], edx
push esi
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [esp + 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
mov ebp, dword [esp + 0x54]
shl ebx, 8
or ebx, eax
mov esi, dword [ebp]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x48], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
je 0x4d6792
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x40]
sub ebx, ebp
dec dword [esp + 0x14]
test esi, esi
jne 0x4d670b
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004d5490
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x38], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x3a], al
mov byte [esp + 0x39], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x3c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3d], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
mov al, byte [esp + esi + 0x30]
xor al, byte [ebp]
inc esi
mov byte [ebx + ebp], al
inc ebp
and esi, 7
cmp dword [esp + 0x14], 0
jne 0x4d66a7
cmp dword [esp + 0x10], 0
je 0x4d6779
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
pop edi
mov dword [ebp], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
Function at 0x4d8bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ebx
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0xc], edx
push esi
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [esp + 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
mov ebp, dword [esp + 0x54]
shl ebx, 8
or ebx, eax
mov esi, dword [ebp]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x48], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
je 0x4d8d82
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x40]
sub ebx, ebp
dec dword [esp + 0x14]
test esi, esi
jne 0x4d8cfb
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004d7bc0
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x38], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x3a], al
mov byte [esp + 0x39], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x3c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3d], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
mov al, byte [esp + esi + 0x30]
xor al, byte [ebp]
inc esi
mov byte [ebx + ebp], al
inc ebp
and esi, 7
cmp dword [esp + 0x14], 0
jne 0x4d8c97
cmp dword [esp + 0x10], 0
je 0x4d8d69
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
pop edi
mov dword [ebp], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
Function at 0x4d8da0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.004f8af0
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x527040
push ebx
call fcn.004f8b20
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x4d8dd1
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4d8df0
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8dff
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e0e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e1d
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4d8e2a
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e39
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e48
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e57
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4d8e64
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e73
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e82
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4d8e91
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [esp + 0x1c]
jne 0x4d8de6
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea ecx, [ecx]
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004d7bc0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4d8eb0
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call fcn.004d7bc0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x4d8ed8
pop esi
pop ebx
add esp, 8
ret
Function at 0x4d9920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, dword [esp + 0x48]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [esp + 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x31], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x30], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x34], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ebx
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
test ebp, ebp
je 0x4d9af2
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x40]
sub eax, ebp
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
test esi, esi
jne 0x4d9a6b
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004d8f10
mov ebx, dword [esp + 0x28]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, dword [esp + 0x2c]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x3c], al
shr eax, 0x18
shr ecx, 8
shr edx, 0x10
add esp, 8
inc dword [esp + 0x1c]
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], bl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov cl, byte [esp + esi + 0x30]
xor cl, byte [ebp]
inc esi
mov byte [eax + ebp], cl
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x4d9a05
cmp dword [esp + 0x1c], 0
je 0x4d9ad9
mov eax, dword [esp + 0x2c]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x24]
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
Function at 0x4d9b10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov byte [edi], 0
cmp eax, 0x80
jle 0x4d9b2a
mov eax, 0x80
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x4d9b3a
cmp ecx, 0x400
jle 0x4d9b3f
mov ecx, 0x400
test eax, eax
jle 0x4d9b5a
mov esi, dword [esp + 0x18]
push ebp
mov edx, edi
sub esi, edi
mov ebp, eax
mov edi, edi
mov bl, byte [esi + edx]
mov byte [edx], bl
inc edx
dec ebp
jne 0x4d9b50
pop ebp
movzx edx, byte [edi + eax - 1]
cmp eax, 0x80
jge 0x4d9b8e
mov esi, edi
sub esi, eax
lea ebx, [ebx]
movzx ebx, byte [esi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x5485c0]
mov byte [eax + edi], dl
inc eax
cmp eax, 0x80
jl 0x4d9b70
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + edi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [esi]
and ebx, ecx
movzx ecx, byte [ebx + 0x5485c0]
mov byte [esi], cl
test eax, eax
je 0x4d9bd4
lea esp, [esp]
movzx ebx, byte [esi + edx - 1]
dec esi
xor ebx, ecx
dec eax
movzx ecx, byte [ebx + 0x5485c0]
mov byte [esi], cl
jne 0x4d9bc0
lea ecx, [edi + 0xfc]
lea eax, [edi + 0x7e]
mov edx, 0x40
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
dec edx
jne 0x4d9be2
pop edi
pop esi
pop ebx
ret
Function at 0x4dace0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ebx
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0xc], edx
push esi
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [esp + 0x2c], eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
movzx eax, byte [eax + 6]
mov ebp, dword [esp + 0x54]
shl ebx, 8
or ebx, eax
mov esi, dword [ebp]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x48], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
je 0x4daeb2
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x40]
sub ebx, ebp
dec dword [esp + 0x14]
test esi, esi
jne 0x4dae2b
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004da010
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x38], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x3a], al
mov byte [esp + 0x39], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x3c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3d], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
mov al, byte [esp + esi + 0x30]
xor al, byte [ebp]
inc esi
mov byte [ebx + ebp], al
inc ebp
and esi, 7
cmp dword [esp + 0x14], 0
jne 0x4dadc7
cmp dword [esp + 0x10], 0
je 0x4dae99
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x2c]
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 5], cl
mov byte [eax + 6], dl
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
pop edi
mov dword [ebp], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f7824
add esp, 0x2c
ret