joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47db4c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47dc02
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004048e4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x47dbec
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404a70
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.004048e4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47dbec
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x47dc14
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47dbec
cmp dword [ebp - 8], 0x34
jne 0x47dbec
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dc09
lea eax, [ebp - 0x10]
call fcn.00404414
ret

Function at 0x47f200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47f291
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53f6a0]
cmp dword [eax], 2
jne 0x47f240
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x47f273
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404c68
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004046ac
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.004048e4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f298
lea eax, [ebp - 8]
call fcn.00404b30
lea eax, [ebp - 4]
call fcn.00404414
ret

Function at 0x47f730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.004048e4
mov edx, eax
mov eax, ebx
call fcn.0047ef54
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0047f1a8
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x47f7a2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004048e4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4803f4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x480506
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x48042a
mov eax, dword [ebp - 4]
test eax, eax
jne 0x480436
push 0x57
call sub.kernel32.dll_SetLastError
jmp 0x4804f0
test ebx, ebx
jne 0x48043f
mov ebx, 0x1000
push 0x5426cc
call sub.kernel32.dll_InterlockedIncrement_1
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [0x5426cc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x24]
mov ecx, 2
mov eax, 0x480524
call fcn.0040a2a8
push edi
push 0x1d4c0
push ebx
push ebx
push 1
push 0
push 0x40000001
mov eax, dword [ebp - 0xc]
call fcn.004048e4
push eax
call sub.kernel32.dll_CreateNamedPipeA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4804f0
push 0
push 0x80
push 3
push edi
push 0
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.004048e4
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4804e2
call sub.kernel32.dll_GetLastError
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_SetLastError
jmp 0x4804f0
mov dword [esi], ebx
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48050d
lea eax, [ebp - 0xc]
call fcn.00404414
ret
Function at 0x480574
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd10
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004048d4
lea eax, [ebp - 0x140]
mov edx, dword [0x480064]
call fcn.00404ffc
lea eax, [ebp - 0x260]
mov edx, dword [0x480064]
call fcn.00404ffc
xor eax, eax
push ebp
push 0x480c58
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x2c0], 0xc
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], 0xffffffff
mov edx, dword [0x480064]
lea eax, [ebp - 0x140]
call fcn.004050cc
mov edx, 0x120
call fcn.00480010
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov al, byte [ebp + 0x20]
mov byte [ebp - 0x28], al
push 0
lea ecx, [ebp - 0x2c0]
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x140]
call fcn.004803f4
test eax, eax
jne 0x48064e
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x480c0e
push 0
push 0
push 0
lea ecx, [ebp - 0x2c0]
mov dl, 1
mov eax, dword [0x47fc68]
call fcn.0047ff24
mov dword [ebp - 0x24], eax
mov edx, dword [0x480064]
lea eax, [ebp - 0x260]
call fcn.004050cc
mov edx, 0x120
call fcn.00480010
mov eax, ebx
xor al, 1
test al, al
je 0x480713
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14c], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x148], al
push 0
lea ecx, [ebp - 0x2c0]
lea edx, [ebp - 0x25c]
lea eax, [ebp - 0x260]
call fcn.004803f4
test eax, eax
jne 0x4806f5
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x13c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x140]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x24]
call fcn.004035c4
jmp 0x480c0e
push 0
push 0
push 0
lea ecx, [ebp - 0x2c0]
mov dl, 1
mov eax, dword [0x47fc68]
call fcn.0047ff24
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x2a4]
mov edx, 0x44
call fcn.00480010
mov dword [ebp - 0x2a4], 0x44
mov dword [ebp - 0x278], 0x101
add dword [eax], eax
add byte [esi - 0x39], ah
test dword [ebp + edi*8 + 0xffff], ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480c5f
lea eax, [ebp - 0x2f0]
mov edx, 2
call fcn.00404438
lea eax, [ebp - 0x260]
mov edx, dword [0x480064]
mov ecx, 2
call fcn.00405118
lea eax, [ebp - 0x14]
mov edx, dword [0x48054c]
call fcn.00405b0c
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x4810c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.00481080
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x481138
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x5426d4], eax
mov ebx, 0x48100c
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x481138
xor eax, eax
push ebp
push 0x481131
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481138
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x481140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.00481080
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4811ab
mov ebx, dword [0x5426d4]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4811ab
xor eax, eax
push ebp
push 0x4811a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4811ab
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x486908
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x486936
mov eax, ebx
call fcn.004873bc
cmp dword [ebx + 0x40], 0
je 0x48692f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4869a7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x486999
cmp dword [ebx + 8], 0
je 0x486958
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48696a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x486999
cmp dword [ebx + 8], 0
je 0x48694b
cmp eax, 3
je 0x48697d
dec eax
jne 0x48694b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48694b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48694b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4869c5
cmp dword [ebx + 0x14], 0xcc
je 0x4869c5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004869d0
pop ebx
ret
Function at 0x4a45e8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004a5130
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4a502c
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4a5071
lea eax, [ebp - 0x60]
call fcn.004a45e8
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004a4610
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004a46e0
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4a5073
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4a509a
mov bl, byte [esi]
xor bl, 0x36
mov byte [eax], bl
mov bl, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4a50a0
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4a5081
lea eax, [ebp - 0x60]
call fcn.004a45e8
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004a4610
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004a4f94
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004a46e0
lea eax, [ebp - 0x60]
call fcn.004a45e8
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004a4610
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004a4610
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004a46e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a7d48
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x4a7d5c
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x4a7d5b
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
shl eax, 2
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00404a70
xor ebx, ebx
cmp esi, dword [esp]
jge 0x4a7ec5
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi]
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x4a7e7d
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov cl, byte [ebp + esi + 1]
and cl, 0xf0
and ecx, 0xff
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x4a7e4c
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov cl, byte [ebp + esi + 2]
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
jmp 0x4a7eb9
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040493c
mov byte [eax + ebx - 1], 0x3d
jmp 0x4a7eb9
inc ebx
mov eax, edi
call fcn.0040493c
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov dl, byte [edx + 0x52fd14]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040493c
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.0040493c
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x4a7d8d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b5b24
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x5351bc
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4b5b43
mov esi, 1
mov edx, 0x5352c4
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4b5bbd
dec ebx
je 0x4b5be1
dec ebx
je 0x4b5c05
dec ebx
je 0x4b5c28
jmp 0x4b5c41
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b5c41
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b5c41
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b5c41
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4b5baa
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4b5b5f
mov esi, 0x20
mov eax, 0x5351ec
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4b5c66
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b5ca0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x535273]
test bl, bl
jbe 0x4b5cd1
lea eax, [esi + 0x3e0]
call fcn.004b5c80
lea eax, [esi + 0x3fc]
call fcn.004b5c80
dec bl
jne 0x4b5cb7
mov cl, 0x30
mov edi, 0x535244
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x4b5cf3
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4b5d02
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4b5cdb
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b5d10
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004b5ab8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b5d2c
mov bl, 0x1c
mov esi, 0x53520c
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004b5ab8
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004b5ab8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4b5d48
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004b5ca0
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4b5d70
mov bl, 1
mov eax, 0x53513c
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4b5da9
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4b5db6
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4b5d95
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4b5de0
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004b5b24
jmp 0x4b5e08
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004b5b24
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4b5e10
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4b5dc8
mov bl, 0x40
mov esi, 0x53517c
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4b5e76
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4b5e85
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4b5e5e
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004b5ae0
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b5e93
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6068
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4b6114
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4b610f
mov eax, ebp
mov edx, 8
call fcn.00404a70
push 1
mov eax, ebp
call fcn.0040493c
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004b5d10
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e8b20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00404ad4
cmp byte [ebp - 1], 0
jne 0x4e8b7e
mov eax, esi
call fcn.0040493c
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4e8b97
sub al, 2
jb 0x4e8b9e
jmp 0x4e8ba3
mov ebx, 2
jmp 0x4e8ba3
mov ebx, 1
mov eax, esi
call fcn.0040493c
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4e8c85
test edi, edi
jle 0x4e8bff
mov eax, esi
call fcn.0040493c
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.0040493c
mov byte [eax + ebx - 1], 0
jmp 0x4e8c79
test edi, edi
jge 0x4e8c45
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.0040493c
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4e8c79
mov eax, esi
call fcn.0040493c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.0040493c
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4e8bbb
mov al, byte [ebp - 1]
sub al, 1
jb 0x4e8c95
sub al, 2
jb 0x4e8cce
jmp 0x4e8d15
cmp edi, 2
jne 0x4e8c9b
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4e8d15
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.0040493c
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x535678]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4e8cab
jmp 0x4e8d15
cmp edi, 2
jne 0x4e8cd4
dec ebx
test ebx, ebx
jle 0x4e8d10
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.0040493c
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x53567c]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4e8ce0
jmp 0x4e8d10
inc ebx
mov eax, esi
call fcn.0040493c
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4e8d03
mov eax, esi
mov edx, ebx
call fcn.00404a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4