joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0x10], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x47fbba
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x47fb79
mov esi, dword [esi]
mov eax, ebp
sub esi, ebp
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x47fba5
test edx, edx
jne 0x47fbb7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [eax + 0x18]
push 0
call fcn.004436b0
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x47fb9b
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x47fb42
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
movzx ecx, byte [ecx + 0x53c2b8]
movzx edx, byte [edx + 0x53c2b8]
sub edx, ecx
jne 0x47fb91
inc eax
jmp 0x47fb66
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x4d61c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x38
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
mov ebp, edx
movlpd qword [esp + 0x2c], xmm0
mov ebx, ecx
mov dword [esp + 0x20], ebp
push 0
movups xmmword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 0x13
call fcn.00502470
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, ebp
mov ecx, ebx
push eax
push 1
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0xa0]
call fcn.004c6630
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4d639e
push dword [esp + 0x3c]
lea eax, [esp + 0x3c]
mov ecx, ebx
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], eax
call fcn.004d1cb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4d639e
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.004d1dd0
mov esi, eax
cmp esi, 0x64
jne 0x4d639e
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x78]
lea edx, [esp + 0x20]
mov ebp, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [esp + 0x20], xmm0
add ebp, edi
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x28], xmm0
call fcn.004c2880
lea esi, [edi + eax]
cmp esi, ebp
jae 0x4d637e
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.004c2880
add esi, eax
cmp esi, ebp
jae 0x4d637a
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x4d6326
cmp ecx, 1
jne 0x4d62e6
test edx, edx
je 0x4d6326
mov eax, dword [esp + 0x28]
add ecx, 0xfffffffe
adc edx, 0xffffffff
add eax, ecx
mov ecx, dword [esp + 0x70]
adc dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x30], eax
push edi
push ebx
push dword [esp + 0x98]
push dword [esp + 0x30]
call fcn.004d6110
xor dword [esp + 0x2c], eax
add esp, 0x18
xor dword [esp + 0x10], edx
jmp 0x4d6372
xorps xmm0, xmm0
or ecx, edx
movlpd qword [esp + 0x30], xmm0
mov ecx, esi
movlpd qword [esp + 0x28], xmm0
je 0x4d6348
lea edx, [esp + 0x30]
call fcn.004c2880
add esi, eax
jmp 0x4d6372
lea edx, [esp + 0x20]
call fcn.004c2880
add esi, eax
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xef], 0
je 0x4d636a
sub ebx, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
jmp 0x4d6372
add ebx, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
cmp esi, ebp
jb 0x4d62b1
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.004d1dd0
mov esi, eax
cmp esi, 0x64
je 0x4d6274
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
jmp 0x4d63a6
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x48]
call fcn.004d2530
mov ecx, dword [esp + 0x8c]
mov edx, edi
pop edi
mov eax, ebp
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x4e0940
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [esp + 0x14], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x4e097c
push dword [esi + 8]
push dword [esi + 4]
push dword [esp + ebx*4 + 0x1c]
push esi
call fcn.004e0860
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x4e0a3c
mov ebp, dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push 1
push edi
call fcn.00464d90
push edi
call fcn.00463aa0
add esp, 0x14
cmp eax, 0x65
jne 0x4e09d3
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push ecx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.004e08e0
add esp, 0x1c
jmp 0x4e0a2a
cmp eax, 0x64
jne 0x4e0a2a
push 0
push edi
call fcn.00464400
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x28]
jne 0x4e09f5
cmp edx, ecx
je 0x4e0a2a
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ebx, ebx
push ebp
push ecx
mov eax, str.__rowid
mov dword [esp + 0x20], str.__parent
cmove eax, dword [esp + 0x20]
push eax
push edx
push dword [esp + 0x2c]
push ebp
push ecx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.004e08e0
add esp, 0x2c
push edi
call fcn.00462aa0
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x4e0a3c
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4eb700
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov bh, byte [ecx + 0x100]
push ebp
mov ebp, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esp + 0xc], edx
mov dl, byte [ecx + 0x101]
test ebp, ebp
je 0x4eb759
push esi
nop
inc bh
movzx esi, bh
mov bl, byte [esi + ecx]
add dl, bl
mov byte [esp + 0x18], dl
movzx edx, dl
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
mov byte [edx + ecx], bl
movzx eax, byte [esi + ecx]
mov edx, dword [esp + 0x10]
add al, bl
movzx eax, al
movzx eax, byte [eax + ecx]
xor byte [edi + edx], al
inc edi
mov dl, byte [esp + 0x18]
cmp edi, ebp
jb 0x4eb720
pop esi
pop edi
pop ebp
mov byte [ecx + 0x101], bh
mov byte [ecx + 0x100], bh
pop ebx
pop ecx
ret
Function at 0x4ee7d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b858
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x55e068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
jne 0x4ee942
test esi, esi
je 0x4ee942
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4ee942
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
cmp eax, dword [ecx + 4]
jne 0x4ee885
cmp edi, 0x40
jb 0x4ee865
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4ee85b
mov edx, dword [esi + 0x3c]
lea eax, [edx + 0xf8]
cmp edi, eax
jb 0x4ee865
cmp dword [edx + esi], 0x4550
mov byte [ebx], 1
sete al
mov byte [ebx + 1], al
jmp 0x4ee942
mov word [ebx], 1
jmp 0x4ee942
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push eax
push edi
call fcn.00407de0
push edi
push esi
push dword [ebx + 4]
call fcn.00501970
add esp, 0xc
jmp 0x4ee942
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041f870
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x1d]
sub esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 0x1d], 0
lea eax, [esi + edi]
push eax
call fcn.00407de0
mov eax, dword [ebp - 0x1c]
push edi
push dword [ebp - 0x24]
add eax, esi
push eax
call fcn.00501970
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
sub eax, edx
push eax
push edx
call fcn.004ee7d0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x4ee942
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4ee923
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ee960
push ecx
push edx
call fcn.004ff563
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff522
mov esp, ebp
pop ebp
ret 8
call fcn.00504f19
int3
Function at 0x4f3270
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x55e068]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00502470
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4f3307
cmp dword [esp + 8], 6
jb 0x4f3307
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004ff522
add esp, 0x118
ret

Function at 0x4f3320
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c190
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x55e068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402450
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.0041d520
mov ecx, eax
call fcn.0041d5e0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402400
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402450
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.0041d520
mov ecx, eax
call fcn.0041d5e0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402400
test ebx, ebx
je 0x4f3435
test esi, esi
je 0x4f3435
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, ecx
push esi
push edi
xor edi, edi
or edx, 0x100
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr eax, 8
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx esi, word [ebx + eax*2]
shr esi, 4
xor esi, ecx
add edi, dword [ebp + esi*4]
cmp edx, 0x10000
jb 0x4f5262
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4f52a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x18]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x4f52b3
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4f5440
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
mov dword [esp], ecx
push ebp
mov ebp, edx
push edi
lea edi, [eax + 1]
test ebp, ebp
je 0x4f5487
push ebx
mov ebx, dword [esp + 0x14]
push esi
movzx edx, word [ecx + edi*2]
mov esi, ebx
and esi, 1
shr edx, 4
mov ecx, esi
shr ebx, 1
neg ecx
add edi, edi
sar ecx, 4
or edi, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [esp + 0x1c]
add eax, dword [ecx + edx*4]
mov ecx, dword [esp + 0x10]
sub ebp, 1
jne 0x4f5457
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x4f55e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, ecx
mov dword [esp + 8], edx
push esi
push edi
movzx esi, word [ebp]
movzx ecx, word [ebp + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
shr esi, 4
mov eax, dword [ebx + eax*4]
mov dword [esp + 0x14], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], esi
cmp esi, dword [esp + 0x24]
jae 0x4f575a
mov edx, esi
xor edi, edi
mov esi, dword [esp + 0x10]
or edx, 8
nop dword [eax + eax]
mov ecx, edx
and edx, 1
shr ecx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + esi*8]
movzx eax, word [ebp + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add edi, dword [ebx + eax*4]
cmp edx, 1
jne 0x4f5650
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [esp + 0x2c], esi
cmp esi, 8
jb 0x4f5636
cmp esi, 0x10
jae 0x4f5702
lea eax, [esi - 8]
mov dword [esp + 0x14], eax
nop dword [eax]
cmp esi, dword [esp + 0x24]
jae 0x4f575a
mov esi, dword [esp + 0x10]
mov edx, eax
xor edi, edi
or edx, 8
mov ecx, edx
and edx, 1
shr ecx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + esi*8]
movzx eax, word [ebp + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add edi, dword [ebx + eax*4]
cmp edx, 1
jne 0x4f56b5
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x4f56a0
cmp esi, dword [esp + 0x24]
jae 0x4f575a
lea eax, [esi - 0x10]
mov dword [esp + 0x2c], eax
nop
xor edi, edi
or eax, 0x100
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebp + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x4f5717
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
cmp esi, dword [esp + 0x24]
jb 0x4f5710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4f72a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x14], ecx
lea eax, [ecx + 0x32350]
mov dword [esp + 0xc], ebp
push edi
mov dword [esp + 0x14], eax
nop dword [eax + eax]
xor ebx, ebx
mov edi, ebp
lea eax, [ebx + 1]
lea ebp, [ebx + 4]
nop word [eax + eax]
movzx edx, word [ecx + eax*2 + 0x329f4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [esp + 0x18]
add ebx, dword [ecx + edx*4 + 0x30ca0]
sub ebp, 1
jne 0x4f72d0
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
inc ebp
mov dword [esp + 0x10], ebp
mov dword [edx], ebx
add edx, 4
mov dword [esp + 0x14], edx
cmp ebp, 0x10
jb 0x4f72c0
pop edi
pop esi
pop ebp
mov dword [ecx + 0x32390], 0
pop ebx
add esp, 0xc
ret
Function at 0x4f7330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebx, ecx
mov ebp, 4
push esi
push edi
lea eax, [ebx + 0x30ca0]
nop word [eax + eax]
movzx edi, byte [ebx + ebp + 0x304a0]
mov edx, edi
mov esi, edi
shr edx, 1
and esi, 1
dec edx
or esi, 2
mov ecx, edx
shl esi, cl
lea ecx, [ebx + 0x3290e]
push eax
mov eax, ebp
sub eax, esi
sub esi, edi
push eax
lea ecx, [ecx + esi*2]
call fcn.004f5440
mov dword [esp + ebp*4 + 0x2c], eax
add esp, 8
inc ebp
lea eax, [ebx + 0x30ca0]
cmp ebp, 0x80
jb 0x4f7350
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 4
sub ecx, ebx
lea ebp, [ebx + 0x31750]
lea esi, [ebx + 0x32710]
mov dword [esp + 0x18], ebp
lea edx, [ebx + 0x31b58]
mov dword [esp + 0x10], esi
sub ecx, 0x31b50
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x32394]
xor edi, edi
test eax, eax
je 0x4f7432
nop dword [eax]
mov ebp, dword [esp + 0x10]
mov eax, edi
xor esi, esi
or eax, 0x40
nop dword [eax + eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebp + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [ebx + ecx*4 + 0x30ca0]
cmp eax, 1
jne 0x4f73f0
mov ebp, dword [esp + 0x18]
mov dword [ebp + edi*4], esi
inc edi
mov eax, dword [ebx + 0x32394]
cmp edi, eax
jb 0x4f73e0
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x4f7457
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [ebx + 0x32394]
jb 0x4f7440
mov eax, dword [ebp]
mov ecx, 4
mov edi, dword [esp + 0x1c]
mov dword [edx - 8], eax
mov eax, dword [ebp + 4]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [ebx + ecx + 0x304a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [ebp + eax*4]
add eax, dword [edx + edi - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x4f7480
mov edx, dword [esp + 0x14]
sub esi, 0xffffff80
add ebp, 0x100
mov dword [esp + 0x10], esi
add edx, 0x200
mov dword [esp + 0x18], ebp
sub edi, 0x200
mov dword [esp + 0x14], edx
sub dword [esp + 0x20], 1
mov dword [esp + 0x1c], edi
jne 0x4f73d0
pop edi
pop esi
pop ebp
mov dword [ebx + 0x3baf8], 0
pop ebx
add esp, 0x214
ret
Function at 0x4f74f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x44
push ebx
mov ebx, ecx
xor edx, edx
push ebp
push esi
push edi
mov dword [ebx + 0x3bad4], 0
lea esi, [ebx + 0x8c]
mov dword [ebx + 0x3bad0], 0
mov dword [esp + 0x1c], ebx
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x48], 0x20
mov dword [ebx + 0x70], 1
mov dword [ebx + 0x64], 4
mov dword [ebx + 0x74], 0
nop word [eax + eax]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4f7550
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 5
mov ecx, ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x48], 0
call fcn.004f4f50
lea edx, [ebx + 0x304a0]
mov eax, 2
mov word [edx], 0x100
mov ebx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
nop
mov ecx, ebx
mov ebp, 1
sar ecx, 1
dec ecx
shl ebp, cl
test ebp, ebp
je 0x4f76ac
lea edi, [eax + edx]
mov ecx, ebp
mov al, bl
mov edx, dword [esp + 0x18]
movzx eax, al
mov esi, ecx
imul eax, eax, 0x1010101
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
add eax, ebp
mov dword [esp + 0x14], eax
inc ebx
cmp ebx, 0x16
jl 0x4f7670
mov ebx, dword [esp + 0x1c]
mov edi, 8
nop dword [eax + eax]
xor edx, edx
mov eax, edi
lea esi, [edx + 4]
nop word [eax + eax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x4f76ea
nop dword [eax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x4f76e0
sub esi, 1
jne 0x4f76d0
mov eax, edi
mov ecx, 0xa1
shr eax, 4
sub ecx, edx
add edi, 0x10
mov dword [ebx + eax*4 + 0x30ca0], ecx
cmp edi, 0x800
jb 0x4f76c0
pop edi
mov dword [ebx + 0x323ac], esi
mov dword [ebx + 0x3bb14], esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x4f86d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push edi
mov ebp, ecx
xor edi, edi
mov eax, dword [eax]
and eax, 7
mov dword [esp + 0x10], ebp
cmp edx, 5
jae 0x4f86f3
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ebp
push esi
mov dword [esp + 0x10], edx
lea esi, [edi + ebp]
cmp esi, edx
jae 0x4f8717
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4f8717
inc esi
cmp esi, edx
jb 0x4f8708
mov edi, esi
sub edi, ebp
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4f8822
cmp ecx, 3
jbe 0x4f8755
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [esp + 0x14], ebx
test cl, cl
je 0x4f8791
cmp cl, 0xff
je 0x4f8791
mov edx, dword [esp + 0x10]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
jmp 0x4f8701
dec ecx
shl eax, cl
and eax, 7
je 0x4f872e
cmp byte [eax + 0x53fe2c], 0
je 0x4f8781
movzx ecx, byte [eax + 0x53fe34]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x4f877d
cmp cl, 0xff
jne 0x4f872e
mov edx, dword [esp + 0x10]
and eax, 3
mov ebx, edi
add eax, eax
or eax, 1
inc edi
jmp 0x4f8701
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
nop
lea ebx, [edx + 5]
add ebx, edi
test eax, eax
je 0x4f87ea
movzx ebp, byte [eax + 0x53fe34]
mov ecx, 0x18
shl ebp, 3
mov edx, ebx
sub ecx, ebp
shr edx, cl
test dl, dl
je 0x4f87d7
cmp dl, 0xff
jne 0x4f87ea
mov ecx, 0x20
mov edx, 1
sub ecx, ebp
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4f87b0
mov ebp, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esp + 0x10]
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [esp + 0x14]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
jmp 0x4f8701
pop esi
pop ebx
cmp ecx, 3
jbe 0x4f8839
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret
dec ecx
shl eax, cl
mov ecx, dword [esp + 0x1c]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret