joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d920
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040b7a8
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00487a20
test ebx, ebx
jne 0x48d973
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0048d79c
mov ebx, eax
test ebx, ebx
je 0x48da69
cmp esi, ebx
je 0x48d99c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x48d9b1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x48d9e9
add eax, 0xffffff5f
sub eax, 2
jb 0x48da01
dec eax
sub eax, 2
jb 0x48da15
dec eax
sub eax, 2
jb 0x48da0b
jmp 0x48da1f
add eax, 0xfffffdff
sub eax, 2
jb 0x48da01
dec eax
sub eax, 2
jb 0x48da15
dec eax
sub eax, 2
jb 0x48da0b
jmp 0x48da1f
mov byte [esp + 0x120], 0
jmp 0x48da27
mov byte [esp + 0x120], 2
jmp 0x48da27
mov byte [esp + 0x120], 1
jmp 0x48da27
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0046b680
mov esi, eax
call fcn.00484324
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004893a4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x48da6b
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4a6a4c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407520
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4a6a93
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00407718
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x4ac290
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac3c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x446f68]
call fcn.0044816c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4ac39f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00448254
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00407718
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4ac3e4
call fcn.004079ec
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004484d0
test al, al
je 0x4ac389
lea ecx, [ebp - 4]
mov edx, 0x4ac458
mov eax, dword [ebp - 0xc]
call fcn.00448dcc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00419e4c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4ac382
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4ac470
mov eax, dword [ebp - 8]
push eax
call fcn.0040c620
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4d32c8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac389
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac3a6
mov eax, dword [ebp - 0xc]
call fcn.004053a0
ret

Function at 0x4ac4d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4ac51b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4ac4fe
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4ac50f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4ac51b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4ae80c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x41d8e8]
call fcn.004082a0
xor eax, eax
push ebp
push 0x4ae956
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d32dc], 0
jne 0x4ae860
mov ecx, dword [0x4d5e8c]
mov dl, 1
mov eax, dword [0x40da9c]
call fcn.004176fc
call fcn.00405e78
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00404c08
mov eax, ebx
call fcn.00407364
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4ae964
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040a4b0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4ae8a7
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4ae8fc
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4ae8f5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00407780
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00407718
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.004126b8
test eax, eax
jne 0x4ae8f5
mov ebx, 0x15
jmp 0x4ae901
mov ebx, 0x10
jmp 0x4ae901
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x4d32dc]
call fcn.004ae678
mov eax, dword [ebp - 4]
call fcn.004ae678
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a4c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae95d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407518
lea eax, [ebp - 0xc]
mov edx, dword [0x41d8e8]
call fcn.00408378
ret
Function at 0x4b379c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x4b37b4
add esp, 0xfffffff0
call fcn.004058d4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4b38ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404294
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x4b38b8
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004ae678
xor eax, eax
push ebp
push 0x4b38a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004ae678
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407780
jmp 0x4b3876
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407dc8
mov eax, dword [ebx + 4]
call fcn.00407888
dec eax
jle 0x4b388a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x4b3864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b38ac
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b38d5
lea eax, [ebp - 4]
call fcn.00407198
ret

Function at 0x4bd3e4
Capabilities:
Create thread

Disassembly:
call fcn.004bcfbc
test al, al
je 0x4bd40b
mov byte [0x4dc6a0], 1
push 0x4dc69c
push 0
push 0
push 0x4bcb88
push 0
push 0
call sub.kernel32.dll_CreateThread_1
ret
Function at 0x4bedcc
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x4bedf2
push edi
push esi
not eax
mov edi, ecx
mov esi, dword [0x4d3ae4]
xor ecx, ecx
test esi, esi
je 0x4bedf3
mov cl, byte [edx]
xor cl, al
shr eax, 8
inc edx
xor eax, dword [esi + ecx*4]
dec edi
jne 0x4bede0
not eax
pop esi
pop edi
ret
push eax
push edx
call fcn.004beda8
mov esi, eax
xor ecx, ecx
pop edx
pop eax
jmp 0x4bede0

Function at 0x4c0a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4c0b0b
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4c0aaf
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c0b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x4c0b94
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
movzx ecx, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x4c0b37
mov eax, dword [ebx]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0ba4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4c0c1f
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4c0bc3
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c1390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4c140b
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4c13af
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x4c1494
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
movzx ecx, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x4c1437
mov eax, dword [ebx]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c14a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4c151f
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00404464
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4c14c3
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c25cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov ebx, eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x18]
shr edx, 1
add ebx, edx
mov ecx, dword [ebp + 8]
mov ecx, edx
mov edx, dword [ebp + 8]
mov edx, ebx
call fcn.00404464
add ebx, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x30]
add edx, edx
add edx, edx
sub edx, 5
test edx, edx
jl 0x4c26a0
inc edx
mov eax, dword [ebx]
mov ecx, eax
and ecx, 0xff
mov esi, dword [str.cw]
movzx ecx, byte [esi + ecx]
mov esi, dword [0x4d6294]
mov ecx, dword [esi + ecx*4 + 0x1000]
mov esi, eax
shr esi, 8
and esi, 0xff
mov edi, dword [str.cw]
movzx esi, byte [edi + esi]
mov edi, dword [0x4d6294]
xor ecx, dword [edi + esi*4 + 0x1400]
mov esi, eax
shr esi, 0x10
and esi, 0xff
mov edi, dword [str.cw]
movzx esi, byte [edi + esi]
mov edi, dword [0x4d6294]
xor ecx, dword [edi + esi*4 + 0x1800]
shr eax, 0x18
mov esi, dword [str.cw]
movzx eax, byte [esi + eax]
mov esi, dword [0x4d6294]
xor ecx, dword [esi + eax*4 + 0x1c00]
mov dword [ebx], ecx
add ebx, 4
dec edx
jne 0x4c2615
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c38b4
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c3a4e
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40d91c]
call fcn.00408f50
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax], 0xf2
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x53
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0x50
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xc6
xor esi, esi
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 1]
movzx eax, dl
movzx eax, byte [eax + 0x4d5d20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
sub al, byte [ecx + esi]
mov ecx, dword [ebp - 4]
add byte [ecx], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
movzx ecx, byte [ecx + esi]
xor al, byte [ecx + 0x4d5d20]
sub dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 1], dl
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
mov eax, edx
mov ecx, dword [ebp - 4]
sub dl, byte [ecx]
movzx eax, al
movzx eax, byte [eax + 0x4d5d20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
add al, byte [ecx + esi]
mov ecx, dword [ebp - 4]
xor al, byte [ecx + 2]
mov ecx, dword [ebp - 4]
mov byte [ecx + 2], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax + esi]
add dl, byte [eax + 0x4d5d20]
mov ecx, dword [ebp - 4]
mov eax, edx
mov byte [ecx + 3], al
mov edx, dword [ebp - 4]
movzx ebx, byte [edx]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
shl edx, 8
add ebx, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
shl edx, 0x10
add ebx, edx
movzx eax, al
shl eax, 0x18
add ebx, eax
mov eax, ebx
shr ebx, 0x1d
shl eax, 3
or ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov ecx, pe_nt_image_headers32
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov ecx, pe_nt_image_headers32
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
shr ebx, 8
mov eax, dword [ebp - 4]
mov byte [eax + 3], bl
inc esi
cmp esi, 4
jne 0x4c3907
mov eax, dword [ebp - 8]
add eax, 4
mov edx, dword [0x40d91c]
call fcn.00409050
mov eax, dword [ebp - 8]
add eax, 4
mov edx, dword [ebp - 4]
mov ecx, dword [0x40d91c]
call fcn.0040908c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3a55
lea eax, [ebp - 4]
mov edx, dword [0x40d91c]
call fcn.00409050
ret
Function at 0x4c3a7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, 3
mov byte [esp + 1], 0
mov eax, dword [edi]
call fcn.00408d88
mov esi, eax
cmp esi, 1
jl 0x4c3adf
mov eax, dword [edi]
movzx ebx, byte [eax + esi - 1]
mov edx, 3
mov eax, ebx
call fcn.004c3028
mov ebx, eax
xor bl, 0x13
mov byte [esp], bl
xor bl, byte [esp + 1]
mov eax, esi
sub bl, al
mov edx, 4
mov eax, ebx
call fcn.004c304c
mov ebx, eax
movzx eax, byte [esp]
mov byte [esp + 1], al
mov eax, dword [edi]
mov byte [eax + esi - 1], bl
dec esi
test esi, esi
jne 0x4c3a9b
mov byte [esp + 1], 0
mov eax, dword [edi]
call fcn.00408d88
mov esi, eax
cmp esi, 1
jl 0x4c3b46
mov eax, dword [edi]
call fcn.00408d88
sub eax, esi
mov edx, dword [edi]
movzx ebx, byte [edx + eax]
sub bl, 0x48
xor bl, 0xff
mov edx, esi
mov eax, ebx
call fcn.004c3028
mov ebx, eax
mov byte [esp], bl
xor bl, byte [esp + 1]
mov eax, esi
sub bl, al
mov edx, 3
mov eax, ebx
call fcn.004c304c
mov ebx, eax
movzx eax, byte [esp]
mov byte [esp + 1], al
mov eax, dword [edi]
call fcn.00408d88
sub eax, esi
mov edx, dword [edi]
mov byte [edx + eax], bl
dec esi
test esi, esi
jne 0x4c3af2
dec ebp
jne 0x4c3a88
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c3b54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov dword [esp], 3
xor ebp, ebp
mov eax, dword [edi]
call fcn.00408d88
mov esi, eax
cmp esi, 1
jl 0x4c3bbe
mov eax, dword [edi]
call fcn.00408d88
sub eax, esi
mov edx, dword [edi]
movzx ebx, byte [edx + eax]
mov edx, 3
mov eax, ebx
call fcn.004c3028
mov ebx, eax
mov eax, esi
add bl, al
mov eax, ebp
xor bl, al
movzx ebp, bl
mov eax, ebp
mov edx, esi
call fcn.004c304c
mov ebx, eax
xor bl, 0xff
add bl, 0x48
mov eax, dword [edi]
call fcn.00408d88
sub eax, esi
mov edx, dword [edi]
mov byte [edx + eax], bl
dec esi
test esi, esi
jne 0x4c3b72
xor ebp, ebp
mov eax, dword [edi]
call fcn.00408d88
mov esi, eax
cmp esi, 1
jl 0x4c3c0a
mov eax, dword [edi]
movzx ebx, byte [eax + esi - 1]
mov edx, 4
mov eax, ebx
call fcn.004c3028
mov ebx, eax
mov eax, esi
add bl, al
mov eax, ebp
xor bl, al
movzx ebp, bl
xor bl, 0x13
mov edx, 3
mov eax, ebx
call fcn.004c304c
mov ebx, eax
mov eax, dword [edi]
mov byte [eax + esi - 1], bl
dec esi
test esi, esi
jne 0x4c3bce
dec dword [esp]
jne 0x4c3b62
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret