joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7410
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
xor ebp, ebp
push ebp
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c7448
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x18
ret 0x10
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ebx
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
xor eax, eax
push 0x10
lea edx, [esp + 0x14]
push edx
mov ecx, 2
mov dword [esp + 0x18], eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x1c], cx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x4c74f5
push 0x64
call fcn.004c3d90
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4c74f5
push edi
push 0x64
push 0
push ebp
call fcn.004caf20
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov dword [ebp + 4], ebx
mov eax, dword [0x53f8b8]
mov dword [ebp], eax
mov eax, dword [esp + 0x44]
mov dword [0x53f8b8], ebp
mov dword [ebp + 0x3c], ecx
lea edi, [ebp + 0xc]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
xor esi, esi
add esp, 0xc
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x60], esi
pop edi
cmp eax, esi
je 0x4c7530
push eax
call fcn.004c3d90
add esp, 4
mov dword [ebp + 0x60], eax
cmp eax, esi
jne 0x4c751e
push ebx
call sub.WSOCK32.dll_closesocket
test ebp, ebp
jne 0x4c7508
push ebp
call fcn.004cb4e1
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x18
ret 0x10
mov ecx, dword [esp + 0x30]
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4c7524
jmp 0x4c7547
push 2
call fcn.004c3d90
mov dword [ebp + 0x60], eax
mov byte [eax], 0
mov edx, dword [ebp + 0x60]
add esp, 4
mov byte [edx + 1], 0
mov ecx, dword [esp + 0x20]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0x18
ret 0x10

Function at 0x4c75d0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x10], eax
movzx edx, word [0x53f8c0]
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x54]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push edx
mov word [esp + 8], ax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 4]
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
push ecx
call sub.WSOCK32.dll_connect
pop esi
test eax, eax
jge 0x4c764a
mov dword [0x416fac], 0x69
xor eax, eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
mov eax, 1
call fcn.004cb3aa
add esp, 0x14
ret 4
Function at 0x4c7660
Capabilities:
Get hostname

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
xor ebx, ebx
xor edi, edi
test esi, esi
jne 0x4c768a
push ebp
call fcn.004c3d90
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4c7688
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, ebx
push ebp
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x4c76ac
mov eax, esi
lea edx, [eax + 1]
jmp 0x4c76a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c76a0
sub eax, edx
lea edi, [eax + 1]
push ebx
call fcn.004cb4e1
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4c76c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x128
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x130]
mov ecx, dword [0x417030]
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 1
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, ebx
sub ecx, eax
jns 0x4c770e
xor ecx, ecx
cmp dword [0x53f8b4], 0
jne 0x4c77b6
imul ecx, ecx, 0x3e8
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0x40
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], ecx
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x4c77b6
mov esi, dword [0x53f8bc]
mov eax, dword [0x417030]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x120]
push edx
push 0
push 0x7fff
push esi
push eax
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x4c77b6
test byte [esi + 1], 0x80
je 0x4c7700
cmp byte [esi + 6], 0x12
jne 0x4c7700
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4c779b
mov ecx, dword [esp + 0x120]
mov dword [eax], ecx
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop esi
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0x128
ret 8
xor eax, eax
jmp 0x4c779d
Function at 0x4c7800
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov eax, dword [0x53f8bc]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
imul ebp, ebp, 0x3e8
push edi
mov dword [esp + 0x10], 1
mov edi, eax
mov ebx, eax
mov esi, 0x7fff
lea ecx, [ecx]
mov eax, dword [esp + 0x124]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0x40
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebp
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x4c78c0
mov ecx, dword [esp + 0x124]
mov edx, dword [ecx + 4]
push 0
push esi
push ebx
push edx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x4c78d9
cmp eax, 0xffffffff
je 0x4c78f2
cmp dword [esp + 0x10], 0
je 0x4c78b3
cmp byte [edi], 0xb2
jne 0x4c7830
mov cl, byte [esp + 0x128]
cmp byte [edi + 6], cl
jne 0x4c7830
test byte [edi + 1], 0x80
je 0x4c7830
movzx esi, word [edi + 2]
mov dword [esp + 0x10], 0
cmp esi, eax
jbe 0x4c790b
sub esi, eax
add ebx, eax
jmp 0x4c7830
pop edi
pop esi
pop ebp
mov dword [0x416fac], 0x63
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x416fac], 0x65
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x416fac], 0x62
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
Function at 0x4c7920
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.004caf20
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push ecx
push 0x41fbf8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
je 0x4c7aa4
cmp esi, 0x20
jae 0x4c7aa4
mov ecx, 0x41fbf0
lea eax, [esp + 0xc]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c79a0
cmp dl, bl
je 0x4c799c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c79a0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4c7980
xor eax, eax
jmp 0x4c79a5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4c7aa4
mov ecx, 0x41fbe8
lea eax, [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c79d6
cmp dl, bl
je 0x4c79d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c79d6
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4c79b6
xor eax, eax
jmp 0x4c79db
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4c7aa4
push 8
lea edx, [esp + 0x10]
push 0x41fbdc
push edx
call fcn.004cccf0
add esp, 0xc
test eax, eax
jne 0x4c7a5f
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push 0x41fbd0
push ecx
mov dword [esp + 0x14], ebx
call fcn.004ce7b7
add esp, 0xc
cmp eax, 1
jne 0x4c7a3d
mov edx, dword [esp + 8]
lea eax, [edx + 1]
and eax, 0x800000ff
jns 0x4c7a30
dec eax
or eax, 0xffffff00
inc eax
movzx ax, byte [eax + 0x417048]
movzx ebx, ax
jmp 0x4c7a7f
xor eax, eax
cmp esi, ebx
jbe 0x4c7a86
movsx ecx, byte [esp + eax + 0xc]
movzx edx, bx
xor ecx, edx
movzx cx, byte [ecx + 0x417048]
inc eax
movzx ebx, cx
cmp eax, esi
jb 0x4c7a43
jmp 0x4c7a7f
xor eax, eax
cmp esi, ebx
jbe 0x4c7a86
movsx edx, byte [esp + eax + 0xc]
movzx ecx, bx
xor edx, ecx
movzx dx, byte [edx + 0x417048]
inc eax
movzx ebx, dx
cmp eax, esi
jb 0x4c7a65
xor eax, eax
cmp ax, bx
jne 0x4c7a8b
mov ebx, 0xff
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.004cb3aa
add esp, 0x108
ret
Function at 0x4c7e70
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 8]
push 0
and eax, 0xfffffffd
push 1
or eax, 1
push 2
mov dword [esi + 8], eax
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4c7f14
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push eax
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov edx, 2
push ecx
mov word [esp + 0x14], dx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x4c7f14
or dword [esi + 0xc], 8
test dword [esi + 0x3c], 0x200000
movzx eax, word [esi + 0x44]
je 0x4c7f01
movzx eax, word [esi + 0x1e]
push 0
push 0
push 0
push eax
push 0
push esi
call fcn.004c7ac0
test eax, eax
jne 0x4c7f36
mov dword [0x416fac], 0x63
or dword [esi + 8], 2
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x18
ret 4
mov edx, dword [0x416fc8]
mov ecx, dword [esp + 0x18]
pop esi
mov dword [edx + 0x14], eax
xor ecx, esp
mov eax, 1
call fcn.004cb3aa
add esp, 0x18
ret 4

Function at 0x4c8210
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x1a4], eax
cmp dword [0x53f8c8], 0
jne 0x4c8311
lea eax, [esp + 0x14]
push eax
push 0x101
mov dword [0x53f8c8], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x4c8311
push 4
push 0x53f8c0
push 0x4225dc
push 7
mov dword [0x53f8c4], 1
call fcn.004c8be0
add esp, 0x10
test eax, eax
je 0x4c8286
mov eax, dword [0x53f8c0]
test eax, eax
je 0x4c8286
cmp eax, 0xffff
jbe 0x4c8290
mov dword [0x53f8c0], 0x574b
push 0x7fff
call fcn.004cce67
add esp, 4
mov dword [0x53f8bc], eax
test eax, eax
je 0x4c830c
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [0x417030], eax
cmp eax, 0xffffffff
je 0x4c830c
mov ecx, 2
push 4
mov word [esp + 8], cx
lea ecx, [esp + 4]
push ecx
push 0x20
push 0xffff
xor edx, edx
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0
mov word [esp + 0x1a], dx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4c830c
mov eax, dword [0x417030]
push 0x10
lea edx, [esp + 8]
push edx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x4c8311
call fcn.004c6fb0
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x1a8
ret
Function at 0x4c8330
Capabilities:
Get hostname
Send data
Send data on socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
call fcn.004c7200
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c8360
sub eax, edx
push 0x100
lea ebx, [eax + 1]
call fcn.004c3d90
mov esi, eax
add esp, 4
cmp esi, edi
je 0x4c83a9
push 0x100
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x4c83a0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c8394
sub eax, edx
lea edi, [eax + 1]
push esi
call fcn.004cb4e1
add esp, 4
push 0x12c
lea ebp, [edi + ebx + 0x20]
push ebp
push 0x12
mov dword [esp + 0x20], ebp
call fcn.004c42e0
mov esi, eax
test esi, esi
je 0x4c84ac
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4c8420
mov ebp, dword [eax]
mov eax, dword [0x416fb0]
and eax, 0xe00000
and ebp, 1
or ebp, eax
call fcn.004c7920
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x18
or ecx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x18]
push ebx
push edx
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
call fcn.004cb570
add esp, 0xc
push edi
lea eax, [ebx + esi + 0x20]
call fcn.004c7660
mov edi, dword [0x5406b8]
test edi, edi
je 0x4c84ac
lea esp, [esp]
mov ecx, 2
mov word [esp + 0x1c], cx
mov eax, dword [edi + 4]
test eax, eax
je 0x4c84a0
movzx edx, word [0x53f8c0]
push edx
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_htons
mov ecx, dword [0x417030]
push 0x10
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push esi
push ecx
call sub.WSOCK32.dll_sendto
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
je 0x4c84ac
mov edi, dword [edi]
test edi, edi
jne 0x4c8450
cmp dword [esp + 0x10], edi
jne 0x4c84bf
cmp dword [0x416fac], 0
jne 0x4c84bf
mov dword [0x416fac], 0x61
push esi
call fcn.004cb4e1
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0x20
ret 0xc
Function at 0x4c8be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, 2
cmp eax, 0xa
ja case.0x4c8bf5.3
jmp dword [eax*4 + 0x4c8d00]
mov edi, 0x422708
jmp case.0x4c8bf5.3
mov edi, 0x4226d0
jmp 0x4c8c2b
mov edi, 0x4226d0
jmp case.0x4c8bf5.3
mov edi, 0x42269c
jmp case.0x4c8bf5.3
mov edi, 0x422668
jmp 0x4c8c2b
mov edi, 0x42262c
jmp 0x4c8c2b
mov edi, 0x4225f0
mov ebx, 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
xor eax, eax
cmp ebx, 2
sete al
mov ebp, 0x20019
add eax, reloc.WSOCK32.dll_accept
cmp dword [0x5406cc], 0
je 0x4c8c58
mov ebp, 0x20119
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4c8c9f
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4c8ceb
cmp ebx, 3
jne 0x4c8ceb
lea edx, [esp + 0x18]
push edx
push ebp
push 0
push edi
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4c8ceb
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
pop edi
sbb eax, eax
pop esi
not eax
and eax, dword [esp + 0x1c]
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c8d30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
cmp ecx, 0x30
ja case.0x4c8d44.1
movzx eax, byte [ecx + 0x4c8e6c]
jmp dword [eax*4 + 0x4c8e5c]
mov ebp, 0x14
jmp 0x4c8d71
xor edx, edx
cmp byte [esp + 0x18], dl
setne dl
lea edx, [edx*8 + 8]
mov ebp, edx
jmp 0x4c8d71
mov ebp, 8
jmp 0x4c8d71
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp esi, ebp
jbe 0x4c8dab
mov eax, dword [esp + 0x1c]
lea edi, [eax + ebp]
mov eax, esi
sub eax, ebp
mov edx, ebp
cmp ebp, eax
jb 0x4c8d8c
mov edx, eax
mov eax, dword [esp + 0x1c]
test edx, edx
jbe 0x4c8da5
mov ecx, edx
mov bl, byte [edi]
xor byte [eax], bl
inc edi
inc eax
sub ecx, 1
jne 0x4c8d96
mov ecx, dword [esp + 0x14]
sub esi, edx
cmp esi, ebp
ja 0x4c8d80
lea eax, [ecx - 0x20]
cmp eax, 0x30
ja case.0x4c8dba.33
movzx edx, byte [eax + 0x4c8eac]
jmp dword [edx*4 + 0x4c8ea0]
mov ebp, 8
jmp 0x4c8dde
movzx ebp, byte [esp + 0x18]
neg ebp
sbb ebp, ebp
and ebp, 0xfffffff4
add ebp, 0x14
jmp 0x4c8dde
mov ebp, 0x14
cmp esi, ebp
jae 0x4c8e15
mov eax, dword [esp + 0x1c]
lea ebx, [eax + esi]
lea esp, [esp]
mov edi, ebp
sub edi, esi
cmp esi, edi
jae 0x4c8dfa
mov edi, esi
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push ebx
call fcn.004cb570
add esi, edi
add esp, 0xc
add ebx, edi
cmp esi, ebp
jb 0x4c8df0
mov ecx, dword [esp + 0x14]
cmp byte [esp + 0x18], 0
je 0x4c8e50
cmp esi, 0x10
jae 0x4c8e50
cmp ecx, 0x20
je 0x4c8e2b
cmp ecx, 0x30
jne 0x4c8e50
mov eax, dword [esp + 0x1c]
mov edx, 0x10
sub edx, esi
push edx
add eax, esi
push 0
push eax
call fcn.004caf20
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x4c9ec0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
cdq
sub eax, edx
push ebp
sar eax, 1
push esi
mov esi, dword [ecx]
add eax, 4
xor ebp, ebp
push edi
mov edi, dword [ecx + 4]
test eax, eax
jle 0x4c9f10
add ebx, 0xc
mov dword [esp + 0x14], eax
mov ecx, edi
xor ecx, ebp
mov eax, esi
call fcn.004c9dd0
movzx ecx, ax
mov edx, eax
shr edx, 0x10
mov dword [ebx - 4], ecx
mov dword [ebx], edx
mov ebp, esi
add ebx, 8
sub dword [esp + 0x14], 1
mov esi, edi
mov edi, eax
jne 0x4c9ee8
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4c9f20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
movzx eax, word [ebp + ebx*4 + 8]
movzx ecx, word [ebp + ebx*4 + 0x10]
push esi
movzx esi, word [ebp + ebx*4 + 0x14]
push edi
movzx edi, word [ebp + ebx*4 + 0xc]
shl edi, 0x10
shl esi, 0x10
or edi, eax
mov eax, dword [esp + 0x1c]
xor edi, dword [eax]
or esi, ecx
xor esi, dword [eax + 4]
xor esi, edi
test ebx, ebx
jle 0x4c9f87
lea edx, [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, esi
call fcn.004c9d10
add dword [esp + 0x18], 4
xor eax, edi
sub dword [esp + 0x10], 1
mov edi, esi
mov esi, eax
jne 0x4c9f64
mov eax, dword [esp + 0x1c]
movzx ecx, word [ebp + ebx*4 + 0x24]
movzx edx, word [ebp + ebx*4 + 0x20]
shl ecx, 0x10
or ecx, edx
movzx edx, word [ebp + ebx*4 + 0x18]
xor edi, esi
xor edi, ecx
movzx ecx, word [ebp + ebx*4 + 0x1c]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 4], edi
pop edi
xor ecx, esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8

Function at 0x4c9fc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
movzx eax, word [ebp + ebx*4 + 0x18]
movzx ecx, word [ebp + ebx*4 + 0x20]
push esi
movzx esi, word [ebp + ebx*4 + 0x24]
push edi
movzx edi, word [ebp + ebx*4 + 0x1c]
shl edi, 0x10
shl esi, 0x10
or edi, eax
mov eax, dword [esp + 0x1c]
xor edi, dword [eax]
or esi, ecx
xor esi, dword [eax + 4]
lea ecx, [ebx - 1]
xor esi, edi
mov dword [esp + 0x10], ecx
test ecx, ecx
jl 0x4ca031
lea edx, [ebp + ecx*4 + 8]
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, esi
call fcn.004c9d10
sub dword [esp + 0x18], 4
xor eax, edi
mov edi, esi
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
test eax, eax
jge 0x4ca008
mov eax, dword [esp + 0x1c]
movzx ecx, word [ebp + ebx*4 + 0x14]
movzx edx, word [ebp + ebx*4 + 0x10]
shl ecx, 0x10
or ecx, edx
movzx edx, word [ebp + ebx*4 + 8]
xor edi, esi
xor edi, ecx
movzx ecx, word [ebp + ebx*4 + 0xc]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 4], edi
pop edi
xor ecx, esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8
Function at 0x4ca0c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, eax
shr edi, 3
and eax, 7
mov ebp, eax
test edi, edi
jbe 0x4ca0ff
mov edi, edi
mov eax, dword [ebx]
xor dword [esi], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor dword [esi + 4], ecx
push esi
push edx
call fcn.004c9f20
mov ebx, esi
dec edi
add esi, 8
test edi, edi
ja 0x4ca0e0
test ebp, ebp
je 0x4ca12b
mov eax, ebx
jbe 0x4ca120
sub esi, ebx
mov edi, ebp
jmp 0x4ca110
mov dl, byte [eax]
mov cl, byte [esi + eax]
mov byte [esi + eax], dl
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x4ca110
mov eax, dword [esp + 0x14]
push ebx
push eax
call fcn.004c9f20
mov ecx, dword [ebx]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], ecx
mov edx, dword [ebx + 4]
pop ebp
mov dword [eax + 4], edx
pop ebx
ret 0x10

Function at 0x4ca140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
push ebp
mov ebx, eax
push esi
mov esi, dword [esp + 0x2c]
shr ebx, 3
and eax, 7
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
je 0x4ca184
sub ebx, 1
jne 0x4ca184
mov ecx, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x18], ecx
jmp 0x4ca1c8
test ebx, ebx
jbe 0x4ca1c4
jmp 0x4ca190
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ebp, dword [esi + 4]
push esi
push eax
mov dword [esp + 0x20], edx
call fcn.004c9fc0
mov ecx, dword [edi]
xor dword [esi], ecx
mov edx, dword [edi + 4]
xor dword [esi + 4], edx
mov eax, dword [esp + 0x18]
add esi, 4
add esi, 4
sub ebx, 1
mov dword [edi], eax
mov dword [edi + 4], ebp
jne 0x4ca190
jmp 0x4ca1c8
mov ebp, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x4ca219
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [esi + 4]
push esi
push eax
mov dword [edi + 4], edx
call fcn.004c9fc0
mov edx, dword [esp + 0x14]
lea eax, [esi + 8]
test edx, edx
jbe 0x4ca205
mov edi, esi
sub edi, eax
mov cl, byte [eax]
mov bl, byte [edi + eax]
xor bl, cl
mov byte [eax], bl
mov byte [edi + eax], cl
inc eax
sub edx, 1
jne 0x4ca1f3
mov ecx, dword [esp + 0x10]
push esi
push ecx
call fcn.004c9fc0
mov edx, dword [esp + 0x18]
xor dword [esi], edx
xor dword [esi + 4], ebp
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0x14
ret 0x10

Function at 0x4cb3aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417270]
jne 0x4cb3b4
repz ret
jmp fcn.004d28ec