joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7198
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d737e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4d733a
mov eax, dword [ebp - 4]
call fcn.004d8b6c
cmp ebx, eax
jge 0x4d733a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c7c44
mov edx, dword [0x4c97d8]
call fcn.00404854
mov esi, eax
mov eax, esi
call fcn.004ca69c
test al, al
je 0x4d7330
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4d7324
xor eax, eax
push ebp
push 0x4d731d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d7750
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00421198
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405d04
mov eax, dword [ebp - 8]
call fcn.00405ad4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d7514
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7368
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4d731c
mov eax, dword [ebp - 4]
call fcn.004d77d4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040df14
jmp 0x4d7368
mov eax, dword [ebp - 8]
call fcn.004055e4
jmp 0x4d7368
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040d2d8
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41b7d0]
call fcn.00411a60
call fcn.00404f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7385
lea eax, [ebp - 0x54]
call fcn.004055e4
ret
Function at 0x4dd974
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4ddb80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58ac18]
cmp dword [eax + 0x26c], 0
jle 0x4ddb62
mov eax, dword [0x58ac18]
cmp dword [eax + 0x268], 0
jle 0x4ddb62
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x4ddb94
call fcn.0040e7a0
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x58b254]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 4]
call fcn.0040d53c
test al, al
je 0x4dda0d
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040d53c
test al, al
je 0x4dda0d
inc ebx
jmp 0x4dd9b7
mov eax, dword [0x58ac18]
mov eax, dword [eax + 0x268]
cdq
push edx
push eax
mov eax, dword [0x58b004]
mov eax, dword [eax]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c288]
call fcn.0042164c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4dda81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58ac18]
mov eax, dword [eax + 0x26c]
cdq
push edx
push eax
mov eax, dword [0x58b004]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.004dd86c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dda88
mov eax, dword [ebp - 8]
call fcn.004046a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddb87
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x4dddfc
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x5833bc
mov ecx, 0x48
call fcn.004035b8
lea edx, [ebp + 0x48]
mov eax, 0x583404
mov ecx, 0x1000
call fcn.004035b8
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x4dde56
xor edi, edi
dec eax
jne 0x4dde44
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x4dde3d
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004dded8
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x4dde74
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004dded8
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x4dde9f
add ebx, 0x400
dec edi
jne 0x4dde9d
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dded8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.004035b8
cmp byte [esp], 0
je 0x4ddf7c
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4ddf06
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4ddff9
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4ddf87
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4de7dc
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.004035b8
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.004035b8
add esp, 0x58
pop ebx
ret

Function at 0x4df290
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x584444
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call sub.kernel32.dll_GetLocalTime
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
movzx eax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
movzx edx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x4df2a0
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e2238
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4e236f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x4e2297
lea edx, [ebp - 0x100c]
mov eax, dword [0x58a968]
call fcn.00407974
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x40b75c]
call fcn.00411a24
call fcn.00404f18
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x4e22ef
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x4e22c4
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x4e22ea
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x4e22d7
inc esi
add ecx, esi
jmp 0x4e22f9
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x4e232f
lea edx, [ebp - 0x1010]
mov eax, dword [0x58a968]
call fcn.00407974
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x40b75c]
call fcn.00411a24
call fcn.00404f18
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004035b8
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.004035b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2376
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405608
ret

Function at 0x4e4250
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e42fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004055e4
mov esi, 3
lea ebx, [esi + 0x41]
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403d1c
mov edx, 0x4e430c
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4e42d7
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004057cc
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004058b0
inc esi
cmp esi, 0x1a
jne 0x4e427d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4302
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x4e48dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4e496c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405854
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 4]
call fcn.004127d0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4973
lea eax, [ebp - 0x114]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x50ed3c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov eax, ebx
call fcn.004055e4
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x50ed6d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.004056d4
add esp, 0x14
pop ebx
ret

Function at 0x512dc8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x512e22
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00512dbc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.005115c8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00511100
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512e29
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x52fafc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x5896c4
movzx edx, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x52fb0a
xor ebx, ebx
mov ecx, 0x5892c4
mov eax, ebx
mov edx, 8
test al, 1
je 0x52fb39
shr eax, 1
xor eax, esi
jmp 0x52fb3b
shr eax, 1
dec edx
jne 0x52fb2f
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x52fb28
pop esi
pop ebx
ret

Function at 0x52fb50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x5892c4
test esi, esi
je 0x52fb65
test edi, edi
jg 0x52fb6c
xor eax, eax
jmp 0x52fc6b
mov ebx, 0xdbc66688
cmp dword [0x5892c0], 0
je 0x52fb7f
call fcn.0052fafc
xor ebx, 0xffffffff
cmp edi, 8
jl 0x52fc47
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x52fb8b
test edi, edi
je 0x52fc66
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x52fc4b
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x530220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x530229
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5303cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00530568
xor eax, eax
push ebp
push 0x5303ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x530278
call fcn.00404fc4
jmp 0x5303b4
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x53033b
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x5302c9
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5302c9
lea eax, [ebp - 0x10]
call fcn.0052ffe4
push dword [ebp - 0x10]
push 0x5303e8
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5302fe
lea eax, [ebp - 0x18]
call fcn.0052ffe4
push dword [ebp - 0x18]
push 0x5303e8
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0x14]
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x530397
lea eax, [ebp - 0x20]
call fcn.0052ffe4
push dword [ebp - 0x20]
push 0x5303e8
push ebx
push 0x5303f4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.005301e8
jmp 0x530397
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x53035e
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x53035e
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x530374
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x530397
lea eax, [ebp - 0x24]
mov ecx, 0x5303f4
mov edx, ebx
call fcn.004058fc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005301e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5303b4
mov eax, dword [ebp - 4]
call fcn.00530574
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5303d6
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00405608
ret
Function at 0x532270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x532291
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x5322a3
cmp byte [esi + edi - 1], 0x20
je 0x532290
mov eax, esi
test eax, eax
je 0x5322ae
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x532370
cmp byte [esi + edi - 1], 0x2e
je 0x532394
jmp 0x532370
cmp byte [esi + edi - 1], 0x2e
jne 0x532318
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x532394
cmp dword [esp + 8], 0xff
jg 0x532394
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x5322fc
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x532304
mov bl, 1
jmp 0x532312
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x532394
jmp 0x53236f
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x53233d
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x53236f
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x53234f
cmp byte [esi + edi - 1], 0x20
je 0x53233c
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x532367
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x532394
jmp 0x53237f
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jle 0x5322c6
cmp dword [esp + 4], 3
jne 0x532394
cmp dword [esp + 8], 0xff
jg 0x532394
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53cc58
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x58989c
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x53cc77
mov esi, 1
mov edx, 0x5899a4
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x53ccf0
dec ebx
je 0x53cd12
dec ebx
je 0x53cd34
dec ebx
je 0x53cd55
jmp 0x53cd6f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x53cd6f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x53cd6f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x53cd6f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x53cce0
inc esi
add edx, 0x40
cmp esi, 9
jne 0x53cc93
mov esi, 0x20
mov eax, 0x5898cc
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x53cd94
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x53cdd0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x589953]
test bl, bl
jbe 0x53ce01
lea eax, [esi + 0x3e0]
call fcn.0053cdac
lea eax, [esi + 0x3fc]
call fcn.0053cdac
dec bl
jne 0x53cde7
mov cl, 0x30
mov edi, 0x589924
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x53ce22
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x53ce2f
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x53ce0b
pop edx
pop edi
pop esi
pop ebx
ret