joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e19cc
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x57e9fc], 0
mov eax, dword [0x589178]
cmp dword [eax], 2
jne 0x4e1ba5
mov eax, dword [0x5887f8]
cmp dword [eax], 5
jl 0x4e1ba5
call fcn.004d9624
test al, al
jne 0x4e19fd
call fcn.004d9630
call fcn.004d961c
mov dword [0x57ea04], eax
push 0x4e1ba8
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9c8], eax
cmp dword [0x57e9c8], 0
jne 0x4e1a58
mov edx, 0x8000
mov eax, 0x4e1bbc
call fcn.00413908
mov dword [0x57ea00], eax
mov eax, dword [0x57ea00]
mov dword [0x57ea04], eax
push 0x4e1ba8
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9c8], eax
cmp dword [0x57e9c8], 0
je 0x4e1ba0
push 0x4e1bc8
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9cc], eax
cmp dword [0x57e9cc], 0
je 0x4e1ba0
push 0x4e1bd4
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9d0], eax
cmp dword [0x57e9d0], 0
je 0x4e1ba0
mov byte [0x57e9fc], 1
push 0x4e1be4
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9d4], eax
push 0x4e1bf0
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9d8], eax
push 0x4e1bfc
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9dc], eax
push 0x4e1c0c
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9e0], eax
push 0x4e1c1c
mov eax, dword [0x57ea04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9e4], eax
mov edx, 0x8000
mov eax, 0x4e1c34
call fcn.00413908
mov dword [0x57ea08], eax
cmp dword [0x57ea08], 0
je 0x4e1ba5
push 0x4e1c44
mov eax, dword [0x57ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9e8], eax
push 0x4e1c60
mov eax, dword [0x57ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9ec], eax
push 0x4e1c80
mov eax, dword [0x57ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9f0], eax
push 0x4e1c9c
mov eax, dword [0x57ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9f4], eax
push 0x4e1cb4
mov eax, dword [0x57ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x57e9f8], eax
ret
call fcn.004e194c
ret
Function at 0x4e39b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e3ad8
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004e389c
mov eax, dword [esi]
call fcn.00406a2c
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4d47bc]
call fcn.00406be8
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004035b8
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004035b8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00406a2c
mov dword [ebp - 0xc], eax
mov eax, dword [0x588fc0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004d645c
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403e38
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00406a2c
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004d6378
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.004d618c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004d6454
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3adf
lea eax, [ebp - 4]
mov edx, dword [0x4d47bc]
call fcn.00406ce8
ret

Function at 0x4ef6e4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00405d04
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4ef709
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ef728
mov eax, ebx
mov edx, dword [esp]
call fcn.00405d04
pop ecx
pop edx
pop ebx
ret

Function at 0x503558
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x5035b2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0050354c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00500fc4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00500bdc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5035b9
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x5188b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x518916
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.00518994
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x5188fe
lea eax, [ebp - 4]
call fcn.00518994
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x518900
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51891d
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x518924
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x518988
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00518994
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040defc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51898f
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x518f48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x519041
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0051864c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040dadc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00519918
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040d99c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00519990
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519048
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405608
ret
Function at 0x519050
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x519159
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0051864c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x51911f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040dadc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00519918
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040d99c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00519990
jmp 0x519131
xor edx, edx
mov eax, ebx
call fcn.00519918
xor edx, edx
mov eax, ebx
call fcn.00519990
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519160
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405608
ret
Function at 0x51c760
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51c8d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c8ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004057cc
lea eax, [ebp - 0x118]
mov edx, 0x51c8e8
call fcn.004058b0
mov eax, dword [ebp - 0x118]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x51c81e
lea eax, [ebp - 0x111]
call fcn.0040dc94
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004056d4
jmp 0x51c825
mov eax, esi
call fcn.004055e4
cmp bl, 0x61
jae 0x51c846
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.00412920
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405638
jmp 0x51c860
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0041288c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405638
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x51c8f4
call fcn.0040e788
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c8b3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x525568
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.005257a4
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.005257a4
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x5255dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x525602
inc esi
mov eax, edi
call fcn.005255c0
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.00525568
inc ebx
dec esi
jne 0x5255eb
pop edi
pop esi
pop ebx
ret
Function at 0x525698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x52570e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00525608
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.005255c0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00525568
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x5256d8
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525715
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x5263a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52658e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x52654a
mov eax, dword [ebp - 4]
call fcn.00527d7c
cmp ebx, eax
jge 0x52654a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00517d70
mov edx, dword [0x5189e8]
call fcn.00404854
mov esi, eax
mov eax, esi
call fcn.005198ac
test al, al
je 0x526540
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x526534
xor eax, eax
push ebp
push 0x52652d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00526960
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.004210e0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405d04
mov eax, dword [ebp - 8]
call fcn.00405ad4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00526724
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526578
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x52652c
mov eax, dword [ebp - 4]
call fcn.005269e4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040defc
jmp 0x526578
mov eax, dword [ebp - 8]
call fcn.004055e4
jmp 0x526578
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040d2c0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41b7b8]
call fcn.00411a48
call fcn.00404f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526595
lea eax, [ebp - 0x54]
call fcn.004055e4
ret
Function at 0x52caac
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x584574
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x52cacb
mov esi, 1
mov edx, 0x58467c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x52cb44
dec ebx
je 0x52cb66
dec ebx
je 0x52cb88
dec ebx
je 0x52cba9
jmp 0x52cbc3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x52cbc3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x52cbc3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x52cbc3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x52cb34
inc esi
add edx, 0x40
cmp esi, 9
jne 0x52cae7
mov esi, 0x20
mov eax, 0x5845a4
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x52cbe8
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x52cc24
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x58462b]
test bl, bl
jbe 0x52cc55
lea eax, [esi + 0x3e0]
call fcn.0052cc00
lea eax, [esi + 0x3fc]
call fcn.0052cc00
dec bl
jne 0x52cc3b
mov cl, 0x30
mov edi, 0x5845fc
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x52cc76
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x52cc83
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x52cc5f
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x52cc90
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.0052ca44
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x52ccac
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.0052ca44
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0052ca44
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x52ccc8
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.0052cc24
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x52ccf2
mov bl, 1
mov eax, 0x5844f4
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x52cd2b
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x52cd38
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x52cd17
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x52cd62
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.0052caac
jmp 0x52cd89
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.0052caac
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x52cd91
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x52cd4a
mov bl, 0x40
mov esi, 0x584534
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x52cdf7
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x52ce04
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x52cde0
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0052ca6c
inc ebx
inc esi
cmp bl, 0x41
jne 0x52ce12
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52dc64
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x52dd15
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x52dd10
mov eax, ebp
mov edx, 8
call fcn.00405d04
push 1
mov eax, ebp
call fcn.00405ad4
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0052cc90
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret