joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3b68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
jb 0x4917cc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x491829
cmp dword [esi + 0x1c0], 0
jne 0x49185d
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
jb 0x4917ec
mov esi, dword [ebp + 8]
call fcn.0040cf80
test eax, eax
je 0x491829
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
push eax
push esi
mov ecx, 0x51aa08
call fcn.004515c0
test eax, eax
je 0x491829
mov eax, dword [ebp - 0x10]
cmp eax, 3
je 0x491823
cmp eax, 0xffffffff
je 0x491823
mov eax, 1
jmp 0x491825
xor eax, eax
test eax, eax
jne 0x4918a3
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4918b1
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4918a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x491910
jmp 0x4918a7
lea ecx, [ebp - 0x1c]
call fcn.00406520
cmp dword [esi + 0x1c4], 8
lea eax, [esi + 0x1b0]
mov byte [ebp - 4], 2
jb 0x49187a
mov eax, dword [eax]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
jb 0x491886
mov ecx, dword [ebp + 8]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00409130
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x49189e
call fcn.00407520
jmp 0x491829
call fcn.00407520
mov bl, 1
jmp 0x49182b
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x4918fb
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4918f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x491915
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
call fcn.004c98d0
call fcn.004c98d0
int3
Function at 0x493510
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3e36
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [0x4fafac]
mov dword [edi + 4], eax
mov eax, dword [0x4fafb0]
mov dword [edi + 8], eax
mov eax, dword [0x4fafb4]
mov dword [edi + 0xc], eax
mov eax, dword [0x4fafb8]
mov dword [edi + 0x10], eax
mov eax, dword [0x4fafac]
mov dword [edi + 0x14], eax
mov eax, dword [0x4fafb0]
mov dword [edi + 0x18], eax
mov eax, dword [0x4fafb4]
mov dword [edi + 0x1c], eax
mov eax, dword [0x4fafb8]
mov dword [edi + 0x20], eax
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0xfefefefe
mov dword [edi + 0x30], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], vtable.CTransparentWnd_class_CRemindTip_.0
mov dword [edi + 0x54], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x5c], 0xff
mov dword [edi + 0x60], 0
mov dword [edi + 0x58], 0
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 1
call fcn.00438870
mov dword [edi], vtable.CRemindTip.0
xor eax, eax
mov dword [edi + 0x2c], vtable.CRemindTip.1.0
mov dword [edi + 0x50], vtable.CRemindTip.2.0
mov dword [edi + 0x64], vtable.CRemindTip.3.0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0x10c], 0
mov dword [edi + 0x110], 7
mov word [edi + 0xfc], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x494b0f
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x494b14
mov eax, dword [0x521a88]
push ebx
xor ebx, ebx
push esi
test eax, eax
jne 0x494b2f
call fcn.00494c1a
test eax, eax
je 0x494b82
mov eax, dword [0x521a88]
cmp eax, 1
jne 0x494b4e
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x494b82
jmp 0x494bd7
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov esi, eax
test esi, esi
je 0x494b6c
push 0xd
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x494bd7
push 0x40
mov eax, 0x1000
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x494b94
push ebx
push ebx
push ebx
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi]
push edi
push dword [0x521a88]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x494bba
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x494bd6
lea edi, [esi + 0xff0]
push esi
push dword [0x521a88]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x494bc0
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x497110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call sub.msvcrt.dll__beginthreadex
mov dword [esi], eax
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret

Function at 0x499e3e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x499e6a
mov eax, 0x4fc778
push eax
push eax
push edi
push edi
call fcn.0049954a
jmp 0x499e96
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x499e5a
cmp esi, dword [ebp + 0x10]
je 0x499e9d
push 0x4fc778
push 1
push edi
push edi
call fcn.004994fd
add esp, 0x10
xor eax, eax
jmp 0x499ea0
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x49b08c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49b0b6
mov eax, 0x4fc778
push eax
push eax
push 0
push 0
call fcn.0049954a
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x49be05
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x49c348
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x49c761
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4e40ae
call fcn.004a9b70
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.0049c5d8
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x49c7a9
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, esi
call fcn.004a9b30
ret 4
push 0x5154dc
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x49c8a6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.0049ca2a
mov edi, eax
test edi, edi
je 0x49c931
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x49c8e1
mov esi, edi
jmp 0x49c91d
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x49c916
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49c909
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.0049c9c5
jmp 0x49c91d
push 0x4fca68
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x49c91d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.0049ca2a
mov edi, eax
test edi, edi
jne 0x49c8d6
test esi, esi
jne 0x49c946
mov ecx, dword [ebx]
add ecx, 8
call fcn.0049cba3
mov esi, eax
test esi, esi
je 0x49c946
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49e480
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using salsa20 or chacha
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
lea eax, [ebp - 4]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
mov edi, dword [ebp + 0x14]
push 0
push 1
push 0
push 0
push eax
add edi, 0x20
call esi
test eax, eax
jne 0x49e4d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x49e618
push 8
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
je 0x49e618
lea eax, [ebp - 0x44]
push eax
push 0x20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x49e618
push 0x4fcaac
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0049f310
lea eax, [edi + edi]
push eax
call sub.msvcrt.dll_malloc
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x49e618
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
push eax
call sub.msvcrt.dll_memcpy
push dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0049f310
push 0x4fcacc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
push 0x4fcae0
push eax
call fcn.0049f970
lea ecx, [edi + 0x10]
add esp, 0x28
add ecx, ebx
cmp edi, 0x20
jb 0x49e5db
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
push 0x4fcacc
push eax
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.0049f970
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x10]
push eax
push 0
push edi
push ebx
lea esi, [ebx + edi]
push esi
call fcn.0049fe10
mov eax, edi
mov ecx, 0
add eax, 0xffffffe0
push esi
adc ecx, 0xffffffff
push ecx
push eax
lea eax, [esi + 0x20]
push eax
lea eax, [edi + 0x10]
add eax, ebx
push eax
call fcn.004a01a0
xor eax, eax
lea ecx, [edi + 0x10]
mov dword [esi], eax
add esp, 0x3c
mov dword [esi + 4], eax
add ecx, ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov esi, dword [ebp + 0x18]
lea eax, [edi - 0x10]
push eax
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x1c]
add esi, 0xfffffff0
add edi, esi
mov ecx, 8
lea esi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x14]
add ecx, 0x30
push ebx
mov dword [eax], ecx
call sub.msvcrt.dll_free
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e630
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 4]
push 0
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x49e673
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x49e66c
push 8
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x49e673
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
pop esi
setne al
mov esp, ebp
pop ebp
ret

Function at 0x49e970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x49e99b
movsx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51c770]
sub edx, 1
jne 0x49e981
not eax
pop esi
pop ebp
ret
Function at 0x49f310
Capabilities:
Encode data using xor
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push 0x20
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll_memcpy
mov al, byte [ebp - 1]
add esp, 0xc
and byte [ebp - 0x20], 0xf8
and al, 0x3f
mov edx, dword [ebp + 0x10]
or al, 0x40
mov byte [ebp - 1], al
xor ecx, ecx
lea ecx, [ecx]
movzx eax, byte [ecx + edx]
mov dword [ebp + ecx*4 - 0x1a0], eax
inc ecx
cmp ecx, 0x20
jb 0x49f340
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0049ecd0
lea eax, [ebp - 0x120]
push eax
push eax
call fcn.0049f490
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0049f1c0
mov ecx, 0x20
lea esi, [ebp - 0xa0]
lea edi, [ebp - 0x220]
add esp, 0x1c
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
xor edx, edx
jmp 0x49f3b0
mov eax, dword [edx + 0x4fcaf8]
add eax, dword [ebp + edx - 0xa0]
add ecx, eax
movzx eax, cl
mov dword [ebp + edx - 0xa0], eax
add edx, 4
shr ecx, 8
cmp edx, 0x7c
jb 0x49f3b0
mov esi, dword [ebp - 0x24]
sub esi, 0xffffff80
add esi, ecx
mov dword [ebp - 0x24], esi
shr esi, 7
and esi, 1
neg esi
xor edx, edx
lea esp, [esp]
mov eax, dword [ebp + edx - 0xa0]
mov ecx, dword [ebp + edx - 0x220]
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, dword [ebp + edx - 0x9c]
mov dword [ebp + edx - 0xa0], ecx
mov ecx, dword [ebp + edx - 0x21c]
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, dword [ebp + edx - 0x98]
mov dword [ebp + edx - 0x9c], ecx
mov ecx, dword [ebp + edx - 0x218]
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, dword [ebp + edx - 0x94]
mov dword [ebp + edx - 0x98], ecx
mov ecx, dword [ebp + edx - 0x214]
xor ecx, eax
and ecx, esi
xor ecx, eax
mov dword [ebp + edx - 0x94], ecx
add edx, 0x10
cmp edx, 0x80
jb 0x49f3f0
mov edx, dword [ebp + 8]
xor eax, eax
pop edi
pop esi
mov edi, edi
mov cl, byte [ebp + eax*4 - 0xa0]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x20
jb 0x49f470
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49fe10
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
or eax, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
je 0x49ffcb
mov ecx, dword [ebp + 0x18]
push ebx
push edi
mov eax, dword [ecx]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
test edx, edx
jne 0x49fe5c
cmp esi, 0x40
jae 0x49fe5c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
jmp 0x49ff81
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x68]
mov edi, dword [ebp + 0xc]
mov eax, ebx
sub eax, edx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 4], eax
mov eax, edi
sub eax, edx
mov dword [ebp - 8], eax
lea eax, [edi + 2]
mov dword [ebp - 0xc], eax
lea esp, [esp]
push 0x4fcb78
push ecx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004a5610
lea eax, [ebx + 1]
add esp, 0x10
mov ebx, edi
xor esi, esi
sub ebx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x68]
mov ebx, dword [ebp - 4]
lea eax, [eax + 4]
add edx, esi
movzx ecx, byte [edx + ecx]
xor cl, byte [edx]
mov byte [edx + ebx], cl
mov ebx, dword [ebp - 0x18]
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx + 1]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + esi]
xor cl, byte [edx + 2]
mov byte [eax - 3], cl
movzx ecx, byte [esi + edi + 3]
add esi, 4
xor cl, byte [edx + 3]
mov byte [eax - 2], cl
cmp esi, 0x40
jl 0x49fea3
movzx ecx, byte [ebp - 0x20]
movzx eax, byte [ebp - 0x1f]
inc ecx
mov byte [ebp - 0x20], cl
shr ecx, 8
add ecx, eax
mov esi, dword [ebp - 0x10]
movzx eax, byte [ebp - 0x1e]
mov byte [ebp - 0x1f], cl
shr ecx, 8
add ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0x1d]
mov byte [ebp - 0x1e], cl
shr ecx, 8
add ecx, eax
mov ebx, dword [ebp + 0x14]
movzx eax, byte [ebp - 0x1c]
mov byte [ebp - 0x1d], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [ebp - 0x1b]
mov byte [ebp - 0x1c], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [ebp - 0x1a]
mov byte [ebp - 0x1b], cl
shr ecx, 8
add ecx, eax
mov byte [ebp - 0x1a], cl
shr ecx, 8
add byte [ebp - 0x19], cl
add esi, 0xffffffc0
mov ecx, dword [ebp + 0x1c]
adc edx, 0xffffffff
mov dword [ebp - 0x10], esi
add dword [ebp - 4], 0x40
add ebx, 0x40
add dword [ebp - 8], 0x40
add edi, 0x40
add dword [ebp - 0xc], 0x40
mov dword [ebp - 0x14], edx
mov dword [ebp + 0x14], ebx
test edx, edx
ja 0x49fe80
jb 0x49ff7e
cmp esi, 0x40
jae 0x49fe80
mov ecx, dword [ebp + 0x1c]
mov eax, esi
or eax, edx
je 0x49ffc2
push 0x4fcb78
push ecx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004a5610
add esp, 0x10
xor edx, edx
test esi, esi
jle 0x49ffc2
lea eax, [ebp - 0x68]
sub edi, eax
sub ebx, eax
lea ebx, [ebx]
lea ecx, [ebp - 0x68]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [ebx + ecx], al
cmp edx, esi
jl 0x49ffb0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a04b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a0f40

Function at 0x4a04c0
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a1160
Function at 0x4a2820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
mov ebx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, ebx
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x4a28b3
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
lea ecx, [ecx]
movzx eax, word [edx - 2]
lea edx, [edx - 2]
mov ecx, eax
sub ecx, esi
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub ebx, 1
jne 0x4a2870
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
movzx eax, word [edx - 2]
lea edx, [edx - 2]
mov ecx, eax
sub ecx, esi
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub ebx, 1
jne 0x4a2893
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4a29ec
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x38]
mov dword [ebp - 4], ecx
mov ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jbe 0x4a28da
mov ecx, edx
mov dword [ebp + 8], edx
test ecx, ecx
jne 0x4a28e2
xor eax, eax
jmp 0x4a292e
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4a28ff
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a7ea0
jmp 0x4a290f
cmp eax, 2
jne 0x4a2918
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a55f0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
mov ecx, dword [edi + 0x74]
lea ebx, [ecx + eax]
mov dword [edi + 0x74], ebx
cmp ebx, 3
jb 0x4a2959
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x4a296d
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4a2830
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x4a29ec
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x4a29bb
sub ecx, esi
mov dword [ebp + 8], ecx
cmp ecx, 0x102
jbe 0x4a2998
mov ecx, 0x102
mov dword [ebp + 8], ecx
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x4a29ec
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
jbe 0x4a29d5
mov esi, ecx
mov eax, dword [edi + 0x38]
push esi
add eax, edx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a55f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4a55fc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004a5350
Function at 0x4a8b90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x4a8bce
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x4a8bc7
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x4a8bd0
add eax, 0x28
cmp eax, edi
jne 0x4a8bb7
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4a94d0
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret