joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456d94
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 0x4c], 0x67452301
mov dword [ebx + 0x50], 0xefcdab89
mov dword [ebx + 0x54], 0x98badcfe
mov dword [ebx + 0x58], 0x10325476
mov dword [ebx + 0x40], esi
cmp byte [ebp + 8], 0
je 0x456dd1
mov eax, 0x456440
mov dword [ebx + 0x48], eax
jmp 0x456dd9
mov eax, 0x455294
mov dword [ebx + 0x48], eax
cmp esi, 0x40
jl 0x456df5
mov eax, dword [ebp - 4]
mov edx, eax
lea eax, [ebx + 0x4c]
call dword [ebx + 0x48]
add dword [ebp - 4], 0x40
sub esi, 0x40
cmp esi, 0x40
jge 0x456dde
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.00426be0
mov eax, ebx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax], 0x80
inc dword [ebp - 4]
mov eax, 0x37
sub eax, esi
mov esi, eax
test esi, esi
jl 0x456e2c
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.00426aec
jmp 0x456e4f
lea edx, [esi + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
call fcn.00426aec
mov edx, ebx
lea eax, [ebx + 0x4c]
call dword [ebx + 0x48]
mov eax, ebx
xor ecx, ecx
mov edx, 0x38
call fcn.00426aec
mov esi, dword [ebx + 0x40]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
mov dword [ebx + 0x38], eax
shr esi, 0x1d
mov dword [ebx + 0x3c], esi
mov edx, ebx
lea eax, [ebx + 0x4c]
call dword [ebx + 0x48]
mov eax, dword [ebp + 0xc]
lea esi, [ebx + 0x4c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x45c650
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45c656
ret
Function at 0x476878
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476a33
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405954
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x476a4c
call fcn.004054e8
mov eax, ebx
call fcn.0042416c
mov edi, eax
dec edi
test edi, edi
jl 0x476930
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00424140
mov edx, dword [0x468588]
call fcn.00404458
test al, al
je 0x47692c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00424140
lea edx, [ebp - 0x14]
call fcn.004866a4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405954
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405564
inc esi
dec edi
jne 0x4768de
movzx eax, byte [0x476a50]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x476a5c
mov eax, dword [ebp - 8]
call fcn.0040fc50
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00405268
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004866a4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x476a4c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.004866a4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x476a4c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x476a4c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x476a68
call fcn.0040b3d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476a3a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004051f4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004051f4
lea eax, [ebp - 0x14]
call fcn.004051d0
lea eax, [ebp - 0x10]
call fcn.004051d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f4
ret

Function at 0x4ae5f4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403948
ret
Function at 0x4c7288
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405650
xor eax, eax
push ebp
push 0x4c7381
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004c698c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040aae4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c7c58
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a9a4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c7cd0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7388
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051f4
ret
Function at 0x4c7390
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405650
xor eax, eax
push ebp
push 0x4c7499
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004c698c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4c745f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040aae4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c7c58
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a9a4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c7cd0
jmp 0x4c7471
xor edx, edx
mov eax, ebx
call fcn.004c7c58
xor edx, edx
mov eax, ebx
call fcn.004c7cd0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c74a0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051f4
ret

Function at 0x4cdcf0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004cdf2c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004cdf2c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4cdd64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4cdd8a
inc esi
mov eax, edi
call fcn.004cdd48
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004cdcf0
inc ebx
dec esi
jne 0x4cdd73
pop edi
pop esi
pop ebx
ret
Function at 0x4cde20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405650
xor eax, eax
push ebp
push 0x4cde96
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004cdd90
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004cdd48
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004cdcf0
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4cde60
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cde9d
lea eax, [ebp - 4]
call fcn.004051d0
ret
Function at 0x4ceb30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ced16
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4cecd2
mov eax, dword [ebp - 4]
call fcn.004d04d8
cmp ebx, eax
jge 0x4cecd2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c5370
mov edx, dword [0x4c6d28]
call fcn.0040447c
mov esi, eax
mov eax, esi
call fcn.004c7bec
test al, al
je 0x4cecc8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4cecbc
xor eax, eax
push ebp
push 0x4cecb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cf0e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041f220
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004058f0
mov eax, dword [ebp - 8]
call fcn.004056c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ceeac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ced00
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4cecb4
mov eax, dword [ebp - 4]
call fcn.004cf16c
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040aee8
jmp 0x4ced00
mov eax, dword [ebp - 8]
call fcn.004051d0
jmp 0x4ced00
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a2bc
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x419cc4]
call fcn.0040e3d4
call fcn.00404b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ced1d
lea eax, [ebp - 0x54]
call fcn.004051d0
ret
Function at 0x4d3a90
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4d3b2a
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4d3aaf
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4d3b40
dec edx
je 0x4d3b75
jmp 0x4d3bc6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4d3bc6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d5f0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4d5f36
mov ecx, 0x4d5f98
mov dl, 1
mov eax, dword [0x4d551c]
call fcn.0040e398
call fcn.00404b40
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4d5f85
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403308
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4d5f46
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d5fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4d5fda
mov ecx, 0x4d6044
mov dl, 1
mov eax, dword [0x4d551c]
call fcn.0040e398
call fcn.00404b40
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4d6032
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403308
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4d5fec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d6600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d6682
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d5840]
mov eax, 0x14
call fcn.00406110
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409828
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00405224
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x558290]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x558290], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6689
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f4
ret
Function at 0x4d6690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d670c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d5868]
mov eax, 0x10
call fcn.00406110
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409828
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00405224
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x558294]
mov dword [ebx], eax
mov dword [0x558294], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6713
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f4
ret

Function at 0x4d6768
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4d6789
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4d6776
pop edi
pop esi
pop ebx
ret
Function at 0x4e7d50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5582cc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4e7d72
shr eax, 1
xor eax, 0xedb88320
jmp 0x4e7d74
shr eax, 1
dec edx
jne 0x4e7d60
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4e7d59
mov byte [0x5586cc], 1
pop esi
pop ebx
ret

Function at 0x4e7d90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5586cc], 0
jne 0x4e7da7
call fcn.004e7d50
mov eax, edi
dec eax
test eax, eax
jl 0x4e7dcf
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5582cc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4e7db1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4eaa6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4eab06.0
jmp dword [ecx*4 + 0x4eaa9f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4eaad1
sub dl, 8
je 0x4eaae0
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea718
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea770
jmp case.0x4eab06.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4eab06.0
movzx ecx, byte [ecx + 0x4eab0d]
jmp dword [ecx*4 + 0x4eab1e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea81c
jmp case.0x4eab06.0
cmp dl, 3
jne 0x4eab4b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea870
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea82c
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea8b4
jmp case.0x4eab06.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4eab76
sub dl, 8
je 0x4eab82
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea8e0
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4ea94c
jmp case.0x4eab06.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4eaba1
sub dl, 8
je 0x4eabad
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4eaa08
jmp case.0x4eab06.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4eaa30
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x14]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x454]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4eac4b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e9c28
test eax, eax
je 0x4eac4b
mov eax, ebx
call fcn.004eac54
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4eabe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8