joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f19d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4f19ff
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4f1a7e
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004f028c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4f1a4c
mov cx, word [esp]
sub cx, si
jmp 0x4f1a4e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4f1a35
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4f1a74
mov cx, word [esp]
sub cx, si
jmp 0x4f1a76
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4f1a5d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4f1adb
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004f16a4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4f1ac6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4f1adb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4f19da
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f7fa4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5a50b0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4f7fc6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4f7fc8
shr eax, 1
dec edx
jne 0x4f7fb4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4f7fad
mov byte [0x5a54b0], 1
pop esi
pop ebx
ret

Function at 0x4f7fe4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5a54b0], 0
jne 0x4f7ffb
call fcn.004f7fa4
mov eax, edi
dec eax
test eax, eax
jl 0x4f8023
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a50b0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4f8005
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4fa960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4fa9fa.0
jmp dword [ecx*4 + 0x4fa993]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4fa9c5
sub dl, 8
je 0x4fa9d4
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa60c
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa664
jmp case.0x4fa9fa.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4fa9fa.0
movzx ecx, byte [ecx + 0x4faa01]
jmp dword [ecx*4 + 0x4faa12]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa710
jmp case.0x4fa9fa.0
cmp dl, 3
jne 0x4faa3f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa764
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa720
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa7a8
jmp case.0x4fa9fa.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4faa6a
sub dl, 8
je 0x4faa76
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa7d4
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa840
jmp case.0x4fa9fa.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4faa95
sub dl, 8
je 0x4faaa1
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa8fc
jmp case.0x4fa9fa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4fa924
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4fab45
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004f9b18
test eax, eax
je 0x4fab45
mov eax, ebx
call fcn.004fab50
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4faade
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fab50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4fab81
dec al
je 0x4fabbc
dec al
je 0x4fac01
dec al
je 0x4fac6a
jmp 0x4facf4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4facf4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4fab91
jmp 0x4facf4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4facf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4fabcc
jmp 0x4facf4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4facf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4fac30
xor ebp, ebp
jmp 0x4fac40
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4fac49
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4fac11
jmp 0x4facf4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4facf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4facc3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004f802c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4fac7e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ff460
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x579b48
test edx, edx
jne 0x4ff473
xor eax, eax
jmp 0x4ff588
mov dword [esp], 1
cmp byte [esp], 0
je 0x4ff490
push ecx
push edx
push eax
call fcn.004ff58c
add esp, 0xc
jmp 0x4ff588
push ecx
push edx
push eax
call fcn.004ff84c
add esp, 0xc
jmp 0x4ff588
pop edx
pop esi
pop ebx
ret
Function at 0x5010f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x501133
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x5011b4
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.004fe7b8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x501181
mov cx, word [ebp - 4]
sub cx, si
jmp 0x501183
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50116a
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x5011a9
mov cx, word [ebp - 4]
sub cx, si
jmp 0x5011ab
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x501192
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x501216
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.00500dc4
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x501201
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x501216
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x501107
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5096bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50982d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x509808
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004055bc
lea eax, [ebp - 0x118]
mov edx, 0x509844
call fcn.004056a0
mov eax, dword [ebp - 0x118]
call fcn.00405864
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x50977a
lea eax, [ebp - 0x111]
call fcn.0040b5d0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004054c4
jmp 0x509781
mov eax, esi
call fcn.004053d4
cmp bl, 0x61
jae 0x5097a2
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040feb0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405428
jmp 0x5097bc
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040fe1c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405428
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x509850
call fcn.0040c09c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50980f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x50eea4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x50ef02
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0050ef80
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x50eeea
lea eax, [ebp - 4]
call fcn.0050ef80
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x50eeec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ef09
lea eax, [ebp - 4]
call fcn.004053d4
ret

Function at 0x50ef10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x50ef74
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0050ef80
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ef7b
lea eax, [ebp - 4]
call fcn.004053d4
ret
Function at 0x50f534
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x50f62d
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0050ec34
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b3f4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0050ff04
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2b4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0050ff7c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f634
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053f8
ret
Function at 0x50f63c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x50f745
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0050ec34
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x50f70b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b3f4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0050ff04
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2b4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0050ff7c
jmp 0x50f71d
xor edx, edx
mov eax, ebx
call fcn.0050ff04
xor edx, edx
mov eax, ebx
call fcn.0050ff7c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f74c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053f8
ret

Function at 0x51604c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00516288
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00516288
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x5160c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5160e6
inc esi
mov eax, edi
call fcn.005160a4
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.0051604c
inc ebx
dec esi
jne 0x5160cf
pop edi
pop esi
pop ebx
ret
Function at 0x51617c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x5161f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.005160ec
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.005160a4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0051604c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x5161bc
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5161f9
lea eax, [ebp - 4]
call fcn.004053d4
ret
Function at 0x516e8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x517072
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x51702e
mov eax, dword [ebp - 4]
call fcn.00518860
cmp ebx, eax
jge 0x51702e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0050d5ec
mov edx, dword [0x50efd4]
call fcn.00404580
mov esi, eax
mov eax, esi
call fcn.0050fe98
test al, al
je 0x517024
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x517018
xor eax, eax
push ebp
push 0x517011
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00517444
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041fbd0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405af4
mov eax, dword [ebp - 8]
call fcn.004058c4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00517208
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51705c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x517010
mov eax, dword [ebp - 4]
call fcn.005174c8
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b810
jmp 0x51705c
mov eax, dword [ebp - 8]
call fcn.004053d4
jmp 0x51705c
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040ac3c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x419c04]
call fcn.0040efec
call fcn.00404d08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517079
lea eax, [ebp - 0x54]
call fcn.004053d4
ret
Function at 0x51d738
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
xor eax, eax
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x51d816
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp + 8]
jge 0x51d816
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
mov byte [ebp - 0x13], 0xae
movzx ecx, byte [ebp - 0x10]
add byte [ebp - 0x13], cl
xor dl, byte [ebp - 0x13]
lea ecx, [ebx + 2]
movzx esi, dl
shr esi, cl
mov ecx, esi
or cl, byte [ebp - 0x12]
and cl, 0x3f
mov byte [ebp - 0x11], cl
lea ecx, [ebx + 2]
push ecx
mov ecx, 8
pop esi
sub ecx, esi
movzx edx, dl
shl edx, cl
shr edx, 2
and dl, 0x3f
mov byte [ebp - 0x12], dl
add ebx, 2
cmp ebx, 6
jge 0x51d7ce
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
jmp 0x51d80a
mov edx, dword [ebp + 8]
dec edx
cmp eax, edx
jge 0x51d7f6
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 1], dl
add eax, 2
jmp 0x51d804
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x51d768
test ebx, ebx
jle 0x51d828
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 8]
mov byte [edx + eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x51d838
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 2
xor eax, eax
xor edi, edi
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x51d8f4
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub ecx, 0x3c
js 0x51d888
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub cl, 0x3c
mov byte [ebp - 0xd], cl
jmp 0x51d88c
xor edi, edi
jmp 0x51d8f4
cmp edi, dword [ebp + 8]
jge 0x51d8f4
lea ecx, [eax + 6]
cmp ecx, 8
jl 0x51d8d0
mov ecx, 6
sub ecx, esi
movzx eax, byte [ebp - 0xd]
and al, 0x3f
movzx eax, al
shr eax, cl
or al, byte [ebp - 0xe]
mov cl, 0xae
mov ebx, edi
add cl, bl
xor al, cl
mov ecx, dword [ebp - 8]
mov byte [ecx + edi], al
inc edi
xor eax, eax
cmp esi, 6
jge 0x51d8c9
add esi, 2
jmp 0x51d8d0
mov esi, 2
jmp 0x51d8ea
mov ecx, esi
movzx ebx, byte [ebp - 0xd]
shl bl, cl
and bl, byte [esi + 0x581186]
mov byte [ebp - 0xe], bl
mov ecx, 8
sub ecx, esi
add eax, ecx
inc edx
dec dword [ebp - 0x14]
jne 0x51d86d
mov eax, dword [ebp - 8]
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4