joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416c56
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040de61
and dword [ebp - 0x14], 0
cmp dword [0x4259c8], 0
mov dword [ebp - 0x18], eax
jne 0x416d09
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416db1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x416db1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4259c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4259cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4259d0], eax
call edi
push eax
call esi
mov dword [0x4259d8], eax
test eax, eax
je 0x416d09
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4259d4], eax
mov eax, dword [0x4259d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416d62
cmp dword [0x4259d8], ecx
je 0x416d62
push eax
call esi
push dword [0x4259d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416d62
test ebx, ebx
je 0x416d62
call edi
test eax, eax
je 0x416d59
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416d59
test byte [ebp - 8], 1
jne 0x416d62
or dword [ebp + 0x10], 0x200000
jmp 0x416d95
mov eax, dword [0x4259cc]
cmp eax, dword [ebp - 0x18]
je 0x416d95
push eax
call esi
test eax, eax
je 0x416d95
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d95
mov eax, dword [0x4259d0]
cmp eax, dword [ebp - 0x18]
je 0x416d95
push eax
call esi
test eax, eax
je 0x416d95
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4259c8]
call esi
test eax, eax
je 0x416db1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416db3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408808
leave
ret
Function at 0x474175
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, entry1
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x474192
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x474183
add dl, dl
jne 0x47419d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4741e9
xor eax, eax
add dl, dl
jne 0x4741aa
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x474286
add dl, dl
jne 0x4741b9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4741c4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4741cf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4741da
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4741e4
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x474189
mov eax, 1
add dl, dl
jne 0x4741f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x474202
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4741ee
sub eax, 2
jne 0x474231
mov ecx, 1
add dl, dl
jne 0x474217
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x474222
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47420e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x474189
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x474248
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x474253
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47423f
cmp eax, 0x7d00
jae 0x474276
cmp eax, 0x500
jb 0x474271
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x474189
cmp eax, 0x7f
ja 0x474279
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x474189
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4742a2
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x474189
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str._SYSTEMROOT_Downloaded_Installations
lea eax, [ebp - 0x414]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x401098
push esi
push 0x2000000
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40107a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040174a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401069
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401069
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80004005
pop esi
call fcn.0040174a
mov esp, ebp
pop ebp
ret

Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x409334
mov edi, eax
push 0x65
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401153
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401148
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40113c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jbe 0x40113c
mov eax, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40113c
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push ebx
push edi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], esi
je 0x401174
pop ebx
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 4
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 4
push 0x10
push str.Setup
push str.Failed_to_locate_MSI_resource
push 0
mov esi, 0x80004005
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x40174a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401754
repz ret
jmp fcn.00401c33

Function at 0x4059b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027b3
and dword [ebp - 4], 0
cmp dword [0x40b5d8], 0
mov ebx, eax
jne 0x405a64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405b15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405b15
push eax
call fcn.00402741
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b5d8], eax
call esi
push eax
call fcn.00402741
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b5dc], eax
call esi
push eax
call fcn.00402741
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b5e0], eax
call esi
push eax
call fcn.00402741
pop ecx
mov dword [0x40b5e8], eax
test eax, eax
je 0x405a64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402741
pop ecx
mov dword [0x40b5e4], eax
mov eax, dword [0x40b5e4]
cmp eax, ebx
je 0x405abc
cmp dword [0x40b5e8], ebx
je 0x405abc
push eax
call fcn.004027bc
push dword [0x40b5e8]
mov esi, eax
call fcn.004027bc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405abc
test edi, edi
je 0x405abc
call esi
test eax, eax
je 0x405ab3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405ab3
test byte [ebp - 0xc], 1
jne 0x405abc
or dword [ebp + 0x10], 0x200000
jmp 0x405af5
mov eax, dword [0x40b5dc]
cmp eax, ebx
je 0x405af5
push eax
call fcn.004027bc
pop ecx
test eax, eax
je 0x405af5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405af5
mov eax, dword [0x40b5e0]
cmp eax, ebx
je 0x405af5
push eax
call fcn.004027bc
pop ecx
test eax, eax
je 0x405af5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b5d8]
call fcn.004027bc
pop ecx
test eax, eax
je 0x405b15
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405b17
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4011b5
pop dword [ebp - 0xc]
mov eax, 0x6cd105f1
sub eax, 0x6c90f43c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa4a1c294
add dword [ebp - 0x1c], 0xa9b082b7
mov dword [ebp - 0x18], 0xaa39f5e8
sub dword [ebp - 0x18], 0x7806a9a3
mov dword [ebp - 0x14], 0x8d73137f
add dword [ebp - 0x14], 0xbed930af
mov dword [ebp - 0x10], 0x7528c7e7
sub dword [ebp - 0x10], 0x7528c7e7
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x91aaaef7
add eax, 0x6e96215d
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x85485dd3
add dword [ebp - 0x1c], 0xef2a0b83
mov dword [ebp - 0x18], 0x55ea458f
sub dword [ebp - 0x18], 0x147de41a
mov dword [ebp - 0x14], 0x47bf7c7c
add dword [ebp - 0x14], 0x1bafeff0
mov dword [ebp - 0x10], 0x80085cc5
add dword [ebp - 0x10], 0x7ff7a33b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3610b
push 0
call eax
mov ecx, 0x3a18
mov edi, eax
mov ebx, 0xea7aa5fd
sub ebx, 0xea38f5fd
add ebx, dword [ebp - 0xc]
mov edx, 0x2254f17c
add edx, 0xa97a2ca2
mov dword [ebp - 8], 0x3559f4d2
mov esi, dword [ebx]
xor dword [ebp - 8], ecx
sub esi, edx
xor dword [ebp - 4], edi
mov dword [edi], esi
sub dword [ebp - 8], esi
add edi, 0x344885e8
add edi, 0xcbb77a1c
add ebx, 0x1e5ba725
add ebx, 0xe1a458df
loop 0x4012cc
add eax, 0x3bccc0b1
sub eax, 0x3bcbe57e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3f430518
add ecx, 0xc0fcfae8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x402b34
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x5c7040], 0x8088405
inc edx
mov dword [0x5c7040], edx
mul edx
mov eax, edx
ret

Function at 0x40db70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
mov ecx, edx
dec ecx
test ecx, ecx
jl 0x40dbe7
inc ecx
mov dword [ebp - 4], 0x136c9856
mov dword [ebp - 8], 0x9abfb3b6
mov dword [ebp - 0xc], 0x7f6a0dbb
mov esi, eax
mov eax, dword [0x5bd2f8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
rol eax, 7
rol edx, 0x1b
xor eax, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 0xc]
xor eax, ebx
push ecx
mov ecx, eax
rol ebx, cl
pop ecx
ror eax, 0xf
xor edx, eax
xor edx, ebx
push ecx
mov ecx, edx
ror ebx, cl
pop ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov ebx, dword [ebp - 4]
xor bl, byte [esi]
mov eax, dword [ebp - 0x10]
xor bl, al
mov byte [esi], bl
push ecx
mov ecx, edx
ror eax, cl
mov dword [ebp - 0x10], eax
pop ecx
inc esi
dec ecx
jne 0x40db9f
popal
mov esp, ebp
pop ebp
ret

Function at 0x41634c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x416352
ret
Function at 0x434414
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x43443e
cmp dword [ebx + 0x64], 0
jne 0x43443e
cmp dword [ebx + 0x6c], 0
jne 0x43443e
mov edi, esi
jmp 0x4344c5
cmp edi, 0xffffffff
jne 0x434446
dec edi
jmp 0x4344c5
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4344c5
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0043317c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x434493
mov cx, word [esp]
sub cx, si
jmp 0x434495
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x43447c
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4344bb
mov cx, word [esp]
sub cx, si
jmp 0x4344bd
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4344a4
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x434522
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004341b0
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x43450d
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x434522
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x43441e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43a868
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0x10]
call fcn.00403e40
mov eax, dword [ebp + 0xc]
call fcn.00403e40
mov eax, dword [ebp + 8]
call fcn.00403e40
xor eax, eax
push ebp
push 0x43a927
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
mov dl, 1
mov eax, dword [0x4397c4]
call fcn.0043a6ec
mov ebx, eax
mov dword [ebx + 8], edi
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 0x10]
call fcn.00403a64
lea eax, [ebx + 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00403a64
mov eax, dword [ebp + 0x2c]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp + 8]
call fcn.00403a64
mov eax, dword [ebp + 0x28]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x34], eax
mov edx, ebx
mov eax, dword [esi + 8]
call fcn.0040dff4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a92e
lea eax, [ebp + 8]
mov edx, 3
call fcn.00403a34
ret

Function at 0x44d1a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x44d1ce
mov eax, ebx
call fcn.0044dc44
cmp dword [ebx + 0x3c], 0
je 0x44d1c7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x44d23f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x44d231
cmp dword [ebx + 8], 0
je 0x44d1f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x44d202
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x44d231
cmp dword [ebx + 8], 0
je 0x44d1e3
cmp eax, 3
je 0x44d215
dec eax
jne 0x44d1e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x44d1e3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x44d1e3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x44d25d
cmp dword [ebx + 0x10], 0xcc
je 0x44d25d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0044d268
pop ebx
ret
Function at 0x48fc50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x48fc7a
cmp dword [ebx + 0x64], 0
jne 0x48fc7a
cmp dword [ebx + 0x6c], 0
jne 0x48fc7a
mov edi, esi
jmp 0x48fd01
cmp edi, 0xffffffff
jne 0x48fc82
dec edi
jmp 0x48fd01
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x48fd01
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0048f04c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48fccf
mov cx, word [esp]
sub cx, si
jmp 0x48fcd1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48fcb8
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48fcf7
mov cx, word [esp]
sub cx, si
jmp 0x48fcf9
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48fce0
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48fd5e
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0048f9ec
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48fd49
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48fd5e
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48fc5a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x495f08
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x5c7824
mov eax, esi
mov edx, 8
test al, 1
je 0x495f24
shr eax, 1
xor eax, 0xedb88320
jmp 0x495f26
shr eax, 1
dec edx
jne 0x495f17
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x495f10
mov byte [0x5c7c24], 1
pop esi
ret

Function at 0x495f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5c7c24], 0
jne 0x495f57
call fcn.00495f08
mov eax, edi
dec eax
test eax, eax
jl 0x495f80
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c7824]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x495f61
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4add88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x118]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4adf0e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x150]
mov eax, dword [ebx + 0x10]
call fcn.00417570
cmp byte [ebp + 8], 0
je 0x4adde1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.00417440
jmp 0x4addef
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.00417440
mov eax, dword [ebx + 0x10]
call fcn.00417568
dec eax
jle 0x4ade35
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.00417438
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.00417568
push eax
push 0x12200
call fcn.00405af0
mov edx, eax
mov eax, edi
call fcn.00417500
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x4ade97
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x118]
call fcn.00417f90
push eax
call fcn.00405be0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4