joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49a220
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49a023
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00499c68
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dba8
cmp al, 1
jne 0x49a023
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00499f30
test al, al
je 0x49a1af
cmp dword [ebp - 8], 0
jge 0x49a041
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00499c68
mov eax, dword [ebp - 0x210]
call fcn.00404ddc
cmp ebx, eax
jge 0x49a08b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00499c68
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4f2a18]
and eax, 0xff
bt dword [edx], eax
jae 0x49a08b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49a09f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00499f9c
cmp ebx, dword [ebp - 8]
je 0x49a1a1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49a0cb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ed8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eca18]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49a18e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ed8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eca18]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044f4f4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403ed8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eca18]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044f4f4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a195
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49a202
cmp dword [ebp - 8], 0
jge 0x49a1ba
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00499c68
mov eax, dword [ebp - 0x218]
call fcn.00404ddc
cmp eax, dword [ebp - 8]
jg 0x49a1f4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00499c68
mov eax, dword [ebp - 0x21c]
call fcn.00404ddc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00499f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a227
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404b40
ret
Function at 0x4af0f8
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x4af108
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4af11d
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4af220
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004af18c
mov esi, eax
mov eax, ebx
call fcn.00403cd0
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4b15ac
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fcc
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x4b1733
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4b1750
call fcn.00405120
test eax, eax
jne 0x4b15f7
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4b175c
call fcn.00404e28
mov eax, esi
mov edx, 0x3c
call fcn.004b0fe0
mov dword [esi + 8], 0x21
mov dword [esi + 0x14], 0x101
mov dword [esi + 0x20], 0x81
mov dword [esi + 0x28], 0x81
mov dword [esi + 0x30], 0x801
mov dword [esi + 0x38], 0x801
mov eax, 0x21
call fcn.00402b3c
mov dword [esi + 4], eax
mov eax, 0x101
call fcn.00402b3c
mov dword [esi + 0x10], eax
mov eax, 0x81
call fcn.00402b3c
mov dword [esi + 0x1c], eax
mov eax, 0x81
call fcn.00402b3c
mov dword [esi + 0x24], eax
mov eax, 0x801
call fcn.00402b3c
mov dword [esi + 0x2c], eax
mov eax, 0x801
call fcn.00402b3c
mov dword [esi + 0x34], eax
push esi
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404ddc
push eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
call sub.wininet.dll_InternetCrackUrlA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4b16ed
mov eax, edi
mov edx, dword [esi + 4]
call fcn.00404d14
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x10]
call fcn.00404d14
mov eax, dword [ebp + 0x18]
mov edx, dword [esi + 0x2c]
call fcn.00404d14
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x1c]
call fcn.00404d14
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x24]
call fcn.00404d14
mov eax, dword [ebp + 0xc]
mov edx, dword [esi + 0x34]
call fcn.00404d14
mov eax, dword [ebp + 8]
mov dx, word [esi + 0x18]
mov word [eax], dx
mov eax, dword [esi + 0x34]
call fcn.00402b6c
mov eax, dword [esi + 0x2c]
call fcn.00402b6c
mov eax, dword [esi + 0x24]
call fcn.00402b6c
mov eax, dword [esi + 0x1c]
call fcn.00402b6c
mov eax, dword [esi + 0x10]
call fcn.00402b6c
mov eax, dword [esi + 4]
call fcn.00402b6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b173a
lea eax, [ebp - 4]
call fcn.00404b1c
ret
Function at 0x4b1764
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4b177d
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4b178a
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4b17a8
cld
pop edi
pop esi
xor ecx, ecx
mov cl, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b17cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
xor ecx, ecx
mov cl, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4b1813
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.00404d80
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00404d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b1fd8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov byte [ebp - 1], dl
mov esi, eax
xor ebx, ebx
test byte [ebp - 1], 1
je 0x4b1fee
add ebx, 0x20
test byte [ebp - 1], 2
je 0x4b1ff7
add ebx, 2
test byte [ebp - 1], 4
je 0x4b1ffe
inc ebx
test byte [ebp - 1], 8
je 0x4b2007
add ebx, 4
test byte [ebp - 1], 0x10
je 0x4b2013
add ebx, 0x100
test byte [ebp - 1], 0x20
je 0x4b201f
add ebx, 0x1000
push ebx
mov eax, esi
call fcn.00404fdc
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b2d60
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4b2e7d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.004b2c28
pop ecx
test al, al
je 0x4b2e58
mov eax, dword [ebp + 8]
push eax
call fcn.004b2a6c
pop ecx
test al, al
jne 0x4b2e58
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x148]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4b2e58
mov eax, dword [ebp + 8]
push eax
mov eax, 0x13
call fcn.004b2aac
pop ecx
test al, al
je 0x4b2e58
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00404d8c
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00409620
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x190]
cmp esi, 0xc8
je 0x4b2e23
mov eax, dword [ebp + 8]
cmp esi, 0xce
jne 0x4b2e58
mov eax, dword [ebp + 8]
push eax
mov eax, 5
call fcn.004b2aac
pop ecx
test al, al
je 0x4b2e58
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00404d8c
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00409620
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004b2a6c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2e84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret

Function at 0x4b7568
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b7596
mov eax, ebx
call fcn.004b801c
cmp dword [ebx + 0x40], 0
je 0x4b758f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b7607
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b75f9
cmp dword [ebx + 8], 0
je 0x4b75b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b75ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b75f9
cmp dword [ebx + 8], 0
je 0x4b75ab
cmp eax, 3
je 0x4b75dd
dec eax
jne 0x4b75ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b75ab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b75ab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b7625
cmp dword [ebx + 0x14], 0xcc
je 0x4b7625
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b7630
pop ebx
ret
Function at 0x4c7bc4
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x4ed708
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4c7c88
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4c7bfc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4c7c9f
dec edx
je 0x4c7ce0
jmp 0x4c7d3d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4c7d3d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c7da4
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4c7dc1
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4c7ed3
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4c7df4
je 0x4c7e40
sub ecx, 0x2b
je 0x4c7e36
sub ecx, 4
je 0x4c7e3b
dec ecx
sub ecx, 0xa
jb 0x4c7e25
jmp 0x4c7e43
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4c7e06
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4c7e14
jmp 0x4c7e43
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4c7e43
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4c7e43
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4c7e43
mov byte [eax], 0x3e
jmp 0x4c7e43
mov byte [eax], 0x3f
jmp 0x4c7e43
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4c7dd3
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4c7e93
cmp byte [esp + 3], 0xff
jne 0x4c7e93
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4c7ecb
cmp dl, 0xff
je 0x4c7ecb
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4c7dcc
add esp, 0xc
pop ebp
pop edi
pop esi
ret
Function at 0x4ca000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4ca02a
mov ecx, 0x4ca090
mov dl, 1
mov eax, dword [0x4c96d0]
call fcn.0040d19c
call fcn.00404470
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4ca07d
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402d70
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov edx, dword [ebx + 0x3c]
add edx, dword [ebx + 0x44]
dec edx
mov byte [edx], al
inc dword [ebp - 8]
inc dword [ebp - 0xc]
dec esi
jne 0x4ca03a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca0a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4ca0d2
mov ecx, 0x4ca13c
mov dl, 1
mov eax, dword [0x4c96d0]
call fcn.0040d19c
call fcn.00404470
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4ca12b
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402d70
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
dec esi
jne 0x4ca0e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca71c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ca79e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c99f4]
mov eax, 0x14
call fcn.00405af4
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409004
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404b70
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4f4278]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4f4278], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca7a5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret
Function at 0x4ca7ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ca828
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c9a1c]
mov eax, 0x10
call fcn.00405af4
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409004
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404b70
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x4f427c]
mov dword [ebx], eax
mov dword [0x4f427c], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca82f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret

Function at 0x4ca898
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4ca8b8
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4ca8a6
pop edi
pop esi
pop ebx
ret
Function at 0x4cbd24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 2
xor eax, eax
xor edi, edi
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x4cbdd5
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub ecx, 0x3c
js 0x4cbd73
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
sub cl, 0x3c
mov byte [ebp - 0xd], cl
jmp 0x4cbd77
xor edi, edi
jmp 0x4cbdd5
cmp edi, dword [ebp + 8]
jge 0x4cbdd5
lea ecx, [eax + 6]
cmp ecx, 8
jl 0x4cbdb6
mov ecx, 6
sub ecx, esi
mov al, byte [ebp - 0xd]
and al, 0x3f
and eax, 0xff
shr eax, cl
or al, byte [ebp - 0xe]
xor al, 0x3e
mov ecx, dword [ebp - 8]
mov byte [ecx + edi], al
inc edi
xor eax, eax
cmp esi, 6
jge 0x4cbdaf
add esi, 2
jmp 0x4cbdb6
mov esi, 2
jmp 0x4cbdcf
mov ecx, esi
mov bl, byte [ebp - 0xd]
shl bl, cl
and bl, byte [esi + 0x4ee7d6]
mov byte [ebp - 0xe], bl
mov ecx, 8
sub ecx, esi
add eax, ecx
inc edx
dec dword [ebp - 0x14]
jne 0x4cbd59
mov eax, dword [ebp - 8]
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4cd844
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4cd873
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4cd8f2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004cc0f8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cd8c0
mov cx, word [esp]
sub cx, si
jmp 0x4cd8c2
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cd8a9
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cd8e8
mov cx, word [esp]
sub cx, si
jmp 0x4cd8ea
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cd8d1
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4cd94f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004cd518
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4cd93a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4cd94f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cd84e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d3ef4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4f42b4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d3f16
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d3f18
shr eax, 1
dec edx
jne 0x4d3f04
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d3efd
mov byte [0x4f46b4], 1
pop esi
pop ebx
ret

Function at 0x4d3f34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4f46b4], 0
jne 0x4d3f4e
call fcn.004d3ef4
mov eax, edi
dec eax
test eax, eax
jl 0x4d3f77
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f42b4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d3f58
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret