joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450310
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5870c4], 0
jne 0x45042e
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x45042e
push edi
push 0
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x45041a
push esi
push edi
call fcn.0051269a
mov esi, eax
add esp, 4
test esi, esi
je 0x450405
push esi
push edi
push 0
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4503fc
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 0
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10c], 0
push eax
push str.StringFileInfo000004B0FileVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4503fc
mov ecx, 0xf
cmp dword [ebp - 0x10c], ecx
cmovb ecx, dword [ebp - 0x10c]
push ecx
push dword [ebp - 0x110]
push 0x5870c4
call fcn.0051b5a0
add esp, 0xc
xor eax, eax
cmp byte [eax + 0x5870c4], 0x2c
jne 0x4503f6
mov byte [eax + 0x5870c4], 0x2e
inc eax
cmp eax, 0x10
jl 0x4503e6
push esi
call fcn.0051267d
add esp, 4
pop esi
mov eax, 0x5870c4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
mov eax, 0x5870c4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x5870c4
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
Function at 0x4507b0
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 3
push dword [ebp + 8]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
pop ebp
ret
Function at 0x490e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x10]
call fcn.0041d4f0
test eax, eax
je 0x490e4a
mov edx, dword [esi]
mov ecx, esi
push eax
call dword [edx + 0x28]
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp eax, 0xa
ja case.0x490e5d.2
movzx eax, byte [eax + 0x491044]
jmp dword [eax*4 + 0x49102c]
cmp edi, 0x13
je 0x490e92
cmp edi, 0x61
je 0x490e92
cmp byte [0x584e40], 0
je case.0x490e5d.2
cmp edi, 0x1a
jne case.0x490e5d.2
mov ecx, esi
call fcn.00491060
pop edi
pop esi
pop ebx
pop ebp
ret 8
lea ecx, [esi + 0x10]
call fcn.0041d330
test eax, eax
je 0x490eaf
pop edi
pop esi
mov dword [eax + 0xac], 3
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 0x28]
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [0x584e60]
mov eax, dword [ecx + 0x70]
shr eax, 1
test al, 1
je case.0x490e5d.2
push str.unlock
call fcn.00402cc0
test al, al
je case.0x490e5d.2
cmp byte [0x591040], 0
mov ecx, esi
sete byte [0x591040]
mov eax, dword [esi]
call dword [eax + 0x18]
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp byte [esi + 0x40], 0
jne case.0x490e5d.2
mov dword [esi + 0x54], 0
lea edi, [esi + 0x44]
mov ecx, dword [0x584e60]
push edi
mov eax, dword [ecx + 0x14]
mov dword [edi], eax
mov eax, dword [ecx + 0x18]
lea ecx, [esi + 0x10]
mov dword [edi + 4], eax
call fcn.0041d230
mov edx, eax
mov dword [ebp + 8], edx
test edx, edx
je case.0x490e5d.2
cmp dword [edx + 0xc], 0x15
jne case.0x490e5d.2
mov ecx, dword [edx + 4]
sub ecx, 0xb
cmp ecx, 9
ja case.0x490e5d.2
mov eax, dword [edx + 0x74]
cmp eax, dword [edx + 0x78]
jne case.0x490e5d.2
mov dword [esi + 0x54], edx
cmp dword [edx + 0x8c], 0
je 0x490fac
xor edi, edi
nop
lea eax, [edi + 0xb]
push eax
lea ecx, [esi + 0x10]
call fcn.0041cd30
mov edx, dword [esi + 0x54]
cmp eax, edx
je 0x490fa0
cmp byte [eax + 0x11], 0
je 0x490fa0
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [edx + 0x8c]
jne 0x490fa0
push eax
lea ecx, [esi + 0x10]
call fcn.0041ce00
inc edi
cmp edi, 0xa
jl 0x490f70
mov edx, dword [ebp + 8]
lea edi, [esi + 0x44]
push edx
lea ecx, [esi + 0x10]
call fcn.0041ce00
mov eax, dword [esi + 0x54]
movss xmm2, dword [edi]
movss xmm1, dword [edi + 4]
pop edi
movss xmm0, dword [eax + 0x28]
addss xmm0, dword [eax + 0x20]
mulss xmm0, dword [0x54159c]
subss xmm2, xmm0
movss xmm0, dword [eax + 0x2c]
addss xmm0, dword [eax + 0x24]
movss dword [esi + 0x4c], xmm2
mulss xmm0, dword [0x54159c]
subss xmm1, xmm0
movss dword [esi + 0x50], xmm1
mov eax, dword [0x584e60]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x3c], eax
mov word [esi + 0x41], 1
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.00491ee0
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.00492930
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x490f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x10]
call fcn.0041d4f0
test eax, eax
je 0x490e4a
mov edx, dword [esi]
mov ecx, esi
push eax
call dword [edx + 0x28]
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp eax, 0xa
ja case.0x490e5d.2
movzx eax, byte [eax + 0x491044]
jmp dword [eax*4 + 0x49102c]
cmp edi, 0x13
je 0x490e92
cmp edi, 0x61
je 0x490e92
cmp byte [0x584e40], 0
je case.0x490e5d.2
cmp edi, 0x1a
jne case.0x490e5d.2
mov ecx, esi
call fcn.00491060
pop edi
pop esi
pop ebx
pop ebp
ret 8
lea ecx, [esi + 0x10]
call fcn.0041d330
test eax, eax
je 0x490eaf
pop edi
pop esi
mov dword [eax + 0xac], 3
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 0x28]
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [0x584e60]
mov eax, dword [ecx + 0x70]
shr eax, 1
test al, 1
je case.0x490e5d.2
push str.unlock
call fcn.00402cc0
test al, al
je case.0x490e5d.2
cmp byte [0x591040], 0
mov ecx, esi
sete byte [0x591040]
mov eax, dword [esi]
call dword [eax + 0x18]
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp byte [esi + 0x40], 0
jne case.0x490e5d.2
mov dword [esi + 0x54], 0
lea edi, [esi + 0x44]
mov ecx, dword [0x584e60]
push edi
mov eax, dword [ecx + 0x14]
mov dword [edi], eax
mov eax, dword [ecx + 0x18]
lea ecx, [esi + 0x10]
mov dword [edi + 4], eax
call fcn.0041d230
mov edx, eax
mov dword [ebp + 8], edx
test edx, edx
je case.0x490e5d.2
cmp dword [edx + 0xc], 0x15
jne case.0x490e5d.2
mov ecx, dword [edx + 4]
sub ecx, 0xb
cmp ecx, 9
ja case.0x490e5d.2
mov eax, dword [edx + 0x74]
cmp eax, dword [edx + 0x78]
jne case.0x490e5d.2
mov dword [esi + 0x54], edx
cmp dword [edx + 0x8c], 0
je 0x490fac
xor edi, edi
nop
lea eax, [edi + 0xb]
push eax
lea ecx, [esi + 0x10]
call fcn.0041cd30
mov edx, dword [esi + 0x54]
cmp eax, edx
je 0x490fa0
cmp byte [eax + 0x11], 0
je 0x490fa0
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [edx + 0x8c]
jne 0x490fa0
push eax
lea ecx, [esi + 0x10]
call fcn.0041ce00
inc edi
cmp edi, 0xa
jl 0x490f70
mov edx, dword [ebp + 8]
lea edi, [esi + 0x44]
push edx
lea ecx, [esi + 0x10]
call fcn.0041ce00
mov eax, dword [esi + 0x54]
movss xmm2, dword [edi]
movss xmm1, dword [edi + 4]
pop edi
movss xmm0, dword [eax + 0x28]
addss xmm0, dword [eax + 0x20]
mulss xmm0, dword [0x54159c]
subss xmm2, xmm0
movss xmm0, dword [eax + 0x2c]
addss xmm0, dword [eax + 0x24]
movss dword [esi + 0x4c], xmm2
mulss xmm0, dword [0x54159c]
subss xmm1, xmm0
movss dword [esi + 0x50], xmm1
mov eax, dword [0x584e60]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x3c], eax
mov word [esi + 0x41], 1
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.00491ee0
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.00492930
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x494850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 0x54]
mov eax, dword [esi + 0x54]
cmp eax, 1
jne 0x494890
mov eax, dword [0x584e60]
mov eax, dword [eax + 0x24]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5415d0]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x50], xmm0
call fcn.0044ff30
mov ecx, esi
pop esi
jmp fcn.0041df70
cmp eax, 2
jne 0x4948ed
mov ecx, dword [0x584e60]
call fcn.00401ee0
mov ecx, dword [0x584e60]
call fcn.00402b90
mov eax, dword [0x584e60]
movss xmm1, dword [0x5473cc]
mov eax, dword [eax + 0x24]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5415d0]
cvtpd2ps xmm0, xmm0
subss xmm0, dword [esi + 0x50]
comiss xmm1, xmm0
ja 0x4948e0
movaps xmm0, xmm1
movss dword [esi + 0x50], xmm0
mov ecx, esi
pop esi
jmp fcn.0041df70
cmp byte [esi + 0x6c], 0
jne 0x49492f
mov eax, dword [0x584e60]
movss xmm0, dword [eax + 0x20]
addss xmm0, dword [esi + 0x50]
movss dword [esi + 0x50], xmm0
cmp dword [esi + 0x48], 1
jne 0x494913
pop esi
jmp fcn.00495260
mov ecx, dword [0x584e60]
cmp dword [ecx + 0x3c], 0
jne 0x49492f
comiss xmm0, dword [0x5473cc]
jbe 0x49492f
push 2
call fcn.00402a40
mov ecx, esi
pop esi
jmp fcn.0041df70
Function at 0x49c4b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [ebx + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebx + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
pop esi
mov dword [ebx + 8], edx
pop ebx
pop ebp
ret

Function at 0x49cd00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x49cd37
push esi
call fcn.004abc80
add esp, 4
cmp byte [esi + 0x40], 0
je 0x49cd2e
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x49cd42
cmp eax, 0xcb
jne 0x49cdbe
mov eax, dword [esi + 0x194]
cmp byte [eax + 0x10], 0
je 0x49cda8
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x49cd5f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x194]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x49cda2
cmp eax, 2
je 0x49cda8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x49cd50
cmp eax, 3
je 0x49cd87
cmp eax, 1
jne 0x49cd50
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x49cd50
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x49cd50
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0049cdf0
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x49cde0
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0049cdf0
add esp, 4
pop edi
pop esi
pop ebp
ret
Function at 0x49cdf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x49ce1e
mov eax, dword [esi + 0x184]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x184]
cmp byte [eax + 8], 0
je 0x49cea3
mov ecx, dword [esi + 0x78]
lea ebx, [esi + 0x78]
cmp ecx, dword [esi + 0x60]
jae 0x49ce76
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x49ce57
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x188]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x49ceba
cmp ecx, dword [esi + 0x60]
jb 0x49ce35
mov eax, dword [esi + 0x184]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x184]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x184]
add esp, 8
cmp byte [eax + 8], cl
jne 0x49ce30
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x4a42a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov al, byte [edi + 8]
mov byte [ebp - 0x15], al
cmp al, 3
je 0x4a4488
movzx edx, byte [edi + 9]
test al, 2
mov eax, dword [ebp + 0x10]
mov ecx, edx
push ebx
mov ebx, dword [edi]
je 0x4a4301
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edx
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edx
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, 3
jmp 0x4a430f
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x4a4329
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edx, eax
mov dword [ebp + ecx*4 - 0x14], edx
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x4a4373.3
xor edi, edi
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x4a4346
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x4a434b
mov edi, 1
inc eax
cmp eax, ecx
jl 0x4a4335
test di, di
mov edi, dword [ebp + 8]
je case.0x4a4373.3
movzx eax, byte [edi + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4a4373.3
movzx eax, byte [eax + 0x4a44ac]
jmp dword [eax*4 + 0x4a4498]
mov ecx, dword [edi + 4]
test ecx, ecx
je case.0x4a4373.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x4a4385
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edi + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x4a4373.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x4a43c8
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x4a4373.3
nop word [eax + eax]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x4a4400
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x4a4373.3
mov edi, 0x100
nop dword [eax]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x4a4440
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0050b540
mov esp, ebp
pop ebp
ret
Function at 0x4aa3b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4aa3bc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004aa3d0
Function at 0x4b1ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x4b1f48
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.0050df20
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x4b1ef2
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x4b1f20
mov edi, dword [ebp + 8]
add ebx, esi
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x4b2006
mov ecx, dword [edi + 0x6c]
mov edx, dword [edi + 0x74]
add ecx, edx
add ecx, dword [edi + 0x38]
cmp eax, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
cmovbe ebx, eax
test ebx, ebx
jne 0x4b1f76
xor ebx, ebx
jmp 0x4b1fc5
sub eax, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4b1f93
push ebx
push dword [ecx]
push dword [ecx + 0x30]
call fcn.004bb980
jmp 0x4b1fa3
cmp eax, 2
jne 0x4b1fac
push ebx
push dword [ecx]
push dword [ecx + 0x30]
call fcn.004aa3b0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [ecx + 0x30], eax
push ebx
push dword [ecx]
push dword [ebp - 8]
call fcn.0050df20
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov edx, dword [edi + 0x74]
add edx, ebx
mov dword [ebp - 8], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x4b1ff2
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 8]
cmp edx, 0x106
jae 0x4b2006
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4b1eb2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b28e0
mov ecx, dword [esi]
xor eax, eax
push ebx
push edi
xor edi, edi
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x4b2890
mov esi, dword [esi]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x54d600]
cmp edi, ebx
jl 0x4b2873
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x4b28bd
mov esi, dword [esi + 8]
nop dword [eax]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x54d600]
cmp edi, ebx
jl 0x4b28a0
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, eax
shr edx, 8
pop edi
pop ebx
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], dl
mov edx, eax
mov ecx, dword [esi]
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c1cd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [edx + 0x4c]
mov ebx, 0x100
mov edi, dword [edx + 0x1ac]
cmp esi, 1
mov dword [ebp - 0x18], edi
sete al
mov dword [ebp - 0x14], esi
mov byte [edi + 0x1c], al
mov eax, 0x2fe
push dword [edx + 0x64]
mov ecx, dword [edx + 4]
cmovne eax, ebx
push eax
push 1
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x18], eax
add esp, 0x10
mov eax, dword [edi + 0x14]
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x64], ebx
jle 0x4c1dfa
nop word [eax + eax]
mov ecx, dword [edi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
cmp esi, 1
jne 0x4c1d4c
mov eax, dword [edi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [edi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
nop dword [eax + eax]
cmp esi, edx
jle 0x4c1d94
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x4c1d82
mov eax, dword [ebp - 0xc]
movzx eax, al
movzx ecx, bl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x10]
cmp esi, 0xff
jle 0x4c1d70
mov esi, dword [ebp - 0x14]
cmp esi, 1
jne 0x4c1de1
mov ebx, eax
mov ecx, esi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x4c1dc1
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0xc]
jl 0x4c1d30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4d4a6a
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
and dl, 0xf0
or al, dl
mov byte [esi - 2], cl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4d4a30
pop esi
pop edi
pop ebx
pop ebp
ret