joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12534
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [ebp - 8], 5
jne 0x12588
cmp dword [ebp - 4], 2
jne 0x12569
mov dword [0x15464], 0x77
jmp 0x125f1
cmp dword [ebp - 4], 1
jne 0x1257b
mov dword [0x15464], 0x71
jmp 0x125f1
cmp dword [ebp - 4], esi
jne 0x125e9
mov dword [0x15464], esi
jmp 0x12604
cmp dword [ebp - 8], 6
jne 0x125d4
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x125a1
mov dword [0x15464], 0xb7
jmp 0x125f1
cmp eax, 1
jne 0x125b2
mov dword [0x15464], 0xaf
jmp 0x125f1
cmp eax, 2
jne 0x125c3
mov dword [0x15464], 0xec
jmp 0x125f1
cmp eax, 3
jne 0x125e9
mov dword [0x15464], 0xef
jmp 0x125f1
cmp dword [ebp - 8], 0xa
jne 0x125e9
cmp dword [ebp - 4], esi
jne 0x125e9
mov dword [0x15464], 0xf2
cmp dword [0x15464], esi
je 0x12604
push 0x15460
push dword [0x15464]
push dword [ebp + 8]
call fcn.00011cc2
pop esi
leave
ret 8

Function at 0x164f0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [ebp - 8], 5
jne 0x1655e
cmp dword [ebp - 4], 2
jne 0x1652f
mov dword [0x153dc], 0x80
mov dword [0x153f0], 0x1e1
jmp 0x165f1
cmp dword [ebp - 4], 1
jne 0x16544
mov dword [0x153dc], 0x7a
jmp 0x165c6
cmp dword [ebp - 4], esi
jne 0x165f1
mov dword [0x153dc], esi
mov dword [0x153f0], esi
jmp 0x165f1
cmp dword [ebp - 8], 6
jne 0x165d2
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x16581
mov dword [0x153dc], 0xc2
mov dword [0x153f0], 0x1f8
jmp 0x165f1
cmp eax, 1
jne 0x1659c
mov dword [0x153dc], 0xbe
mov dword [0x153f0], 0x203
jmp 0x165f1
cmp eax, 2
jne 0x165b7
mov dword [0x153dc], 0xdd
mov dword [0x153f0], 0x1e2
jmp 0x165f1
cmp eax, 3
jne 0x165f1
mov dword [0x153dc], 0xe0
mov dword [0x153f0], 0x1e3
jmp 0x165f1
cmp dword [ebp - 8], 0xa
jne 0x165f1
cmp dword [ebp - 4], esi
jne 0x165f1
mov dword [0x153dc], 0xe3
mov dword [0x153f0], 0x1e5
pop esi
leave
ret
Function at 0x165fa
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor edi, edi
push edi
push 0xa
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call esi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push edi
push ebx
cmp eax, 0xc0000004
jne 0x16704
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call ebx
push edi
push dword [ebp - 8]
push edi
call esi
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x1670a
push edi
push dword [ebp - 8]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x16670
push edi
push esi
call ebx
jmp 0x1670a
push 0x800
lea eax, [ebp - 0x818]
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], edi
push dword [esi + 0x44]
call fcn.00011496
test eax, eax
jl 0x166b8
mov ecx, dword [esi + 0x44]
xor eax, eax
mov edx, dword [ebp - 0x14]
cmp dword [eax + edx], ecx
je 0x166af
inc eax
cmp eax, 0x200
jb 0x1669d
jmp 0x166b8
lea eax, [ebp + eax*4 - 0x818]
inc dword [eax]
mov eax, dword [esi]
cmp eax, edi
je 0x166c2
add esi, eax
jmp 0x16685
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x818]
cmp dword [ebp - 0x10], ecx
jae 0x166d6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
inc eax
cmp eax, 0x200
jb 0x166c4
mov eax, dword [ebp - 4]
cmp eax, edi
jbe 0x166ec
mov dword [ebp - 0xc], 1
push edi
push dword [ebp - 0x18]
mov dword [0x153d0], eax
add eax, 4
mov dword [0x153d4], eax
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x1670c
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x16b22
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x18
pop edi
push 0x820
mov dword [ebp - 0x1c], eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
xor esi, esi
push 0x120089
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jge 0x16b70
xor eax, eax
jmp 0x16be1
push 5
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jge 0x16b93
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x16b6c
push esi
push dword [ebp - 0x34]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
cmp edi, esi
je 0x16b88
push esi
push esi
push dword [ebp - 0x34]
lea eax, [ebp - 0xc]
push edi
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
push dword [ebp - 4]
test eax, eax
jge 0x16bd1
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x16b6c
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x17060
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebx, ebx
push ebx
push 0xa
push ebx
call esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push ebx
push edi
cmp eax, 0xc0000004
jne 0x17121
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push ebx
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x17127
push ebx
push dword [ebp - 4]
push esi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x170c0
push ebx
push esi
call edi
jmp 0x17127
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0x20]
push 0x5c
push eax
call dword [sym.imp.ntoskrnl.exe_strrchr]
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, ecx
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
cmp dx, bx
jne 0x17100
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push ebx
push esi
call edi
mov eax, dword [ebp - 8]
jmp 0x17129
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1837a
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00018341
pop ebp
jmp fcn.000168c0
Function at 0x4039ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection], 0x8088405
inc edx
mov dword [ebx + 0x81a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42c80c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42c812
ret

Function at 0x44e9ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44eb5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405800
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x44eb74
call fcn.0040545c
mov eax, ebx
call fcn.0042a6ac
mov edi, eax
dec edi
test edi, edi
jl 0x44ea64
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042a680
mov edx, dword [0x43dc78]
call fcn.00404388
test al, al
je 0x44ea60
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042a680
lea edx, [ebp - 0x14]
call fcn.00456834
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405800
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004054d0
inc esi
dec edi
jne 0x44ea12
mov al, byte [0x44eb78]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x44eb84
mov eax, dword [ebp - 0xc]
call fcn.0041122c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004051d8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00456834
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x44eb74
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
call fcn.00456834
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x44eb74
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x44eb74
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x44eb90
call fcn.0040ca34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44eb64
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405164
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405164
lea eax, [ebp - 0x14]
call fcn.00405140
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405164
ret
Function at 0x49cf40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00405410
mov edx, eax
cmp edx, 0x20
jge 0x49cf72
test edx, edx
jle 0x49cf9c
mov eax, 1
xor bl, byte [esi + eax - 1]
xor ecx, ecx
mov cl, bl
mov bl, byte [ecx + 0x81f364]
inc eax
dec edx
jne 0x49cf5e
jmp 0x49cf9c
mov edi, edx
test edi, edi
jns 0x49cf7b
add edi, 0x1f
sar edi, 5
inc edi
mov eax, 1
cmp edx, eax
jle 0x49cf9c
xor bl, byte [esi + eax - 1]
xor ecx, ecx
mov cl, bl
mov bl, byte [ecx + 0x81f364]
add eax, edi
cmp edx, eax
jg 0x49cf88
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x49cfa4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov bx, word [0x81f664]
cmp dword [esp], 0x20
jge 0x49cfe9
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x49d02d
inc edx
xor esi, esi
movzx edi, bx
shr edi, 8
mov di, word [edi*2 + 0x81f464]
shl ebx, 8
xor di, bx
xor ebx, ebx
mov bl, byte [eax + esi]
xor di, bx
mov ebx, edi
inc esi
dec edx
jne 0x49cfc5
jmp 0x49d02d
mov edx, dword [esp]
test edx, edx
jns 0x49cff3
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x49d02d
movzx edi, bx
shr edi, 8
mov di, word [edi*2 + 0x81f464]
shl ebx, 8
xor di, bx
xor ebx, ebx
mov bl, byte [eax + esi]
xor di, bx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x49d007
mov esi, 2
movzx eax, bx
shr eax, 8
mov ax, word [eax*2 + 0x81f464]
shl ebx, 8
xor ax, bx
movzx edx, cx
shr edx, 8
xor ax, dx
mov ebx, eax
shl cx, 8
dec esi
jne 0x49d032
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x49d060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, dword [reloc.kernel32.dll_DeleteCriticalSection]
cmp dword [esp], 0x20
jge 0x49d0a0
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x49d0e0
inc edx
xor esi, esi
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
shl ebx, 8
xor edi, ebx
xor ebx, ebx
mov bl, byte [eax + esi]
xor edi, ebx
mov ebx, edi
inc esi
dec edx
jne 0x49d080
jmp 0x49d0e0
mov edx, dword [esp]
test edx, edx
jns 0x49d0aa
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x49d0e0
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
shl ebx, 8
xor edi, ebx
xor ebx, ebx
mov bl, byte [eax + esi]
xor edi, ebx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x49d0be
mov esi, 4
mov eax, ebx
shr eax, 0x18
mov eax, dword [eax*4 + reloc.kernel32.dll_DeleteCriticalSection]
shl ebx, 8
xor eax, ebx
mov edx, ecx
shr edx, 0x18
xor eax, edx
mov ebx, eax
shl ecx, 8
dec esi
jne 0x49d0e5
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x49f7c8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x81fe80
xor edx, edx
mov dl, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x49f7d6
xor ebx, ebx
mov ecx, 0x81fa80
mov eax, ebx
mov edx, 8
test al, 1
je 0x49f806
shr eax, 1
xor eax, esi
jmp 0x49f808
shr eax, 1
dec edx
jne 0x49f7fc
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x49f7f5
pop esi
pop ebx
ret

Function at 0x49f81c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x81fa80
test esi, esi
je 0x49f831
test edi, edi
jg 0x49f838
xor eax, eax
jmp 0x49f940
mov ebx, 0xdbc66688
cmp dword [0x81fa7c], 0
je 0x49f84b
call fcn.0049f7c8
xor ebx, reloc.kernel32.dll_DeleteCriticalSection
cmp edi, 8
jl 0x49f91b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x49f857
test edi, edi
je 0x49f93b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x49f91f
mov eax, ebx
xor eax, reloc.kernel32.dll_DeleteCriticalSection
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49f9e8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x820294
xor edx, edx
mov dl, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x49f9f6
xor ebx, ebx
mov ecx, 0x81fe94
mov eax, ebx
mov edx, 8
test al, 1
je 0x49fa26
shr eax, 1
xor eax, esi
jmp 0x49fa28
shr eax, 1
dec edx
jne 0x49fa1c
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x49fa15
pop esi
pop ebx
ret
Function at 0x49fa3c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x81fe94
test esi, esi
je 0x49fa51
test edi, edi
jg 0x49fa58
xor eax, eax
jmp 0x49fb60
mov ebx, 0xdbc88666
cmp dword [0x81fe90], 0
je 0x49fa6b
call fcn.0049f9e8
xor ebx, reloc.kernel32.dll_DeleteCriticalSection
cmp edi, 8
jl 0x49fb3b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x49fa77
test edi, edi
je 0x49fb5b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x49fb3f
mov eax, ebx
xor eax, reloc.kernel32.dll_DeleteCriticalSection
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49fbd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x8202a4
test eax, eax
je 0x49fbe7
test edx, edx
jg 0x49fbec
xor eax, eax
pop esi
pop ebx
ret
mov ecx, 0x96fd8f95
xor ecx, reloc.kernel32.dll_DeleteCriticalSection
cmp edx, 8
jl 0x49fcc1
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
sub edx, 8
cmp edx, 8
jge 0x49fbfd
test edx, edx
je 0x49fce1
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
test edx, edx
jne 0x49fcc5
mov eax, ecx
xor eax, reloc.kernel32.dll_DeleteCriticalSection
pop esi
pop ebx
ret
Function at 0x4a0220
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x8206b8
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4a02e4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4a0258
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4a02fb
dec edx
je 0x4a033c
jmp 0x4a0399
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4a0399
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a03fc
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4a0419
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4a052b
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4a044c
je 0x4a0498
sub ecx, 0x2b
je 0x4a048e
sub ecx, 4
je 0x4a0493
dec ecx
sub ecx, 0xa
jb 0x4a047d
jmp 0x4a049b
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4a045e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4a046c
jmp 0x4a049b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4a049b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4a049b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4a049b
mov byte [eax], 0x3e
jmp 0x4a049b
mov byte [eax], 0x3f
jmp 0x4a049b
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4a042b
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4a04eb
cmp byte [esp + 3], 0xff
jne 0x4a04eb
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4a0523
cmp dl, 0xff
je 0x4a0523
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4a0424
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4a05b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4a05d8
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4a05c6
pop edi
pop esi
pop ebx
ret