joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cfdf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x469668
je 0x44d09b
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d083
mov esi, dword [ebx + 4]
jmp 0x44d07d
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44d06d
cmp dword [ebp - 0xc], 4
jne 0x44d06d
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x44d065
or dword [eax + 0x9c], ecx
jmp 0x44d06d
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x44d031
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x44d014
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x44d937
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x45362a
call fcn.00427dfc
sub esp, 0x11c
mov eax, dword [0x46a4e0]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x44da30
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x44da04
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0041c1d2
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0044d937
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0041b0b7
test bl, bl
jne 0x44da04
or dword [ebp - 4], 0xffffffff
jmp 0x44d975
cmp esi, 0x103
je 0x44da14
cmp esi, 0x3f2
jne 0x44da24
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00426bce
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44ddcb
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x45369d
call fcn.00427dfc
mov eax, 0x1014
call fcn.00426b60
mov eax, dword [0x46a4e0]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x44dec6
push dword [ebp + 0xc]
call fcn.0044dd1c
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x44de14
push dword [ebp + 0x14]
jmp 0x44def7
push esi
call fcn.0043d7d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x44de91
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.0041b4af
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.0041b389
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x44deb4
lea eax, [ebp + 0xc]
push eax
call fcn.0041b3c5
jmp 0x44debc
push dword [ebp + 0x14]
call fcn.0041c1d2
lea ecx, [ebx - 0x10]
call fcn.0041b0b7
jmp 0x44deff
cmp dword [ebp + 0x14], edi
jne 0x44ded2
mov dword [ebp + 0x14], 0x4561e5
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c1d2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00426bce
leave
ret 0x10

Function at 0x44e450
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x44e485
cmp edi, dword [esi + 0xc]
jge 0x44e485
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x44e485
cmp edi, dword [eax + 8]
jge 0x44e485
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x44e487
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x44e58b
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x44e5bf
jmp fcn.004355d1
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x44e630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x44e729
cmp eax, dword [edi + 0xc]
jge 0x44e729
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x44e681
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x44e712
cmp dword [ebp + 0xc], ebx
je 0x44e712
jmp 0x44e6ab
push 0x10
call fcn.0044e31c
cmp eax, ebx
je 0x44e697
mov ecx, eax
call fcn.0044e582
mov esi, eax
jmp 0x44e699
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x44e6c2
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
jmp 0x44e6d2
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_LocalReAlloc]
cmp eax, ebx
jne 0x44e6e4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call fcn.004355d1
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004281f0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x44e724
cmp ecx, dword [esi + 8]
jge 0x44e724
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x44e72a
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x44e7e8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44e816
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x44e834
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044e752
jmp 0x44e834
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44e834
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0044e752
test edi, edi
mov eax, edi
jne 0x44e81e
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x46d210]
test ecx, ecx
je 0x44e8e7
jmp 0x44e7e7
ret 8
Function at 0x258024c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x258024cf
pop dword [ebp - 0x50]
mov eax, 0x9600cc1c
sub eax, 0x7080a74d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc16e3aa3
sub dword [ebp - 0x60], 0x731bf558
mov dword [ebp - 0x5c], 0x2820464c
sub dword [ebp - 0x5c], 0xf5ecfa07
mov dword [ebp - 0x58], 0x4467bf5e
sub dword [ebp - 0x58], 0xf81b7b30
mov dword [ebp - 0x54], 0x6b4b3719
add dword [ebp - 0x54], 0x94b4c8e7
lea eax, [ebp - 0x60]
push eax
mov eax, 0x3c177bf0
add eax, 0xe96a5454
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x71674430
sub dword [ebp - 0x60], 0xfcf4dada
mov dword [ebp - 0x5c], 0xdb315314
add dword [ebp - 0x5c], 0x663b0e61
mov dword [ebp - 0x58], 0xfc2fdf
add dword [ebp - 0x58], 0x62733c8d
mov dword [ebp - 0x54], 0xbc5c11af
sub dword [ebp - 0x54], 0xbc5c11af
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xcebe7a9
add eax, 0x1895e8d7
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0ae
push 0
call eax
mov ecx, 0xc2fa963e
sub ecx, 0xc2fa5576
mov edi, eax
mov esi, 0x25829600
add esi, dword [ebp - 0x50]
mov ebx, 0x1037528e
add ebx, 0xde9ca2e2
mov edx, dword [esi]
xor dword [ebp - 0x24], ecx
sub edx, ebx
xor dword [ebp - 0x30], 0x9a1d4cb
mov dword [edi], edx
add dword [ebp - 0x2c], 0xbbf540be
add edi, 0x66dee4d8
sub edi, 0x66dee4d4
add esi, 4
loop 0x258025eb
add eax, 0xf5f3
mov ebx, eax
add eax, 0x6c6fdee2
add eax, 0x93902123
mov ecx, 0x56c84a06
add ecx, 0xceb7b5fa
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x25807297
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bb95
call fcn.2581acc1
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x25824498]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cc0]
cmp eax, dword [ecx + 4]
jg 0x25807364
cmp byte [0x25823cbc], 0
je 0x2580735e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.258024c0
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580735e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.258024c0
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cd40
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cca0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580735e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.258024c0
pop ecx
pop ecx
call fcn.2581acb0
ret
mov edi, 0x25823cc0
push edi
call fcn.258024c0
cmp dword [0x25823cc0], 0xffffffff
pop ecx
jne 0x258072c5
mov eax, dword [0x25823df0]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258073c2
mov eax, dword [0x258240cc]
push ebx
push str.enableTMSLogging
push 0x2581db80
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258073c6
jmp 0x258073c2
mov al, bl
jmp 0x258073c6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cbc], al
call fcn.258024c0
pop ecx
jmp 0x258072c5
Function at 0x401226
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
jmp 0x40123b
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
and dword [ebp - 4], 0
mov byte [ebp - 0x2c], 0x52
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0x51
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
jmp 0x4012cc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
jmp 0x4012ed
test eax, eax
je 0x40131b
jmp 0x4012fa
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x40131b
jmp 0x401324
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x401716
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x401728
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
jmp 0x401745
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 0x14], eax
jmp 0x40177b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4017e5
jmp 0x401797
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x4017e5
jmp 0x4017c2
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4017e2
push 1
pop ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x243e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ax, bx
cmp ch, ch
push ebp
rol ebp, cl
cwde
mov ebp, esp
shr al, 5
sub esp, 0x18
push edi
ror al, cl
mov dword [esp], esi
not al
push edi
and ax, bx
test eax, 0x3cda2ddf
or ah, bl
pushal
mov dword [esp + 0x1c], ebx
rcl al, cl
movzx eax, al
mov dword [esp + 0x18], edx
movzx ax, al
bt ax, di
mov eax, dword [ebp + 8]
pushal
test eax, eax
mov byte [esp], 0xa5
pushfd
pushfd
pushfd
lea esp, [esp + 0x44]
je 0x2467d
bsf si, sp
cmc
inc si
and dl, bl
mov esi, dword [eax + 0x3c]
sar dl, 4
add esi, eax
bt di, cx
inc edx
shr dl, 1
cmp dh, 0x9c
mov edx, dword [esi + 0x78]
cmc
test edx, edx
call fcn.00030128

Function at 0x3021f
Capabilities:
Encode data using xor

Disassembly:
call fcn.0002afb9
pop eax
xchg ebx, eax
sbb byte [edx], bh
pop edx
enter 0xffffffffffff9c8a, 0x6a
salc
sti
nop
enter 0xffffffffffff8cf0, 0xffffffffffffffaf
mov ebx, 0x1f3fe969
mov byte [0xb1d3996], al
xor esp, ecx
or dword [esp + eax - 0x31], 0x34de46fc
adc byte [ebx - 0x737628e7], dh
pop es
sbb al, 0x23
adc byte [esp + ecx*4 + 0x68dc07ee], dl
mov esi, 0xb88f810c
or dword [esi + 0x73825cd9], 0xffffff96
xchg esi, eax
xchg esi, eax
push esi
sub dh, byte [esp + ebp*4 - 0x54]
jp 0x30254
out dx, al
pop es
fsubr qword [eax - 0x42]
or al, 0x81
invalid
jmp 0x5d46ad8
Function at 0x401b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax]
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], 0x10
mov eax, dword [ebp + 0xc]
xor ecx, dword [eax]
mov dword [ebp - 4], ecx
call fcn.00401aba
add dword [ebp + 0xc], 4
xor eax, edi
dec dword [ebp + 8]
mov edi, dword [ebp - 4]
mov ecx, eax
jne 0x401b1e
mov eax, dword [esi + 0x40]
xor eax, ecx
mov ecx, dword [esi + 0x44]
xor ecx, edi
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
leave
ret

Function at 0x401b51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x44]
mov dword [ebp + 8], 0x10
xor ecx, dword [edi]
mov dword [ebp - 4], ecx
call fcn.00401aba
xor eax, ebx
mov ebx, dword [ebp - 4]
sub edi, 4
dec dword [ebp + 8]
mov ecx, eax
jne 0x401b6f
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
xor eax, ecx
mov ecx, dword [esi]
xor ecx, ebx
pop edi
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
pop esi
mov dword [ecx], eax
pop ebx
leave
ret

Function at 0x41c095
Capabilities:
Hash data with md5

Disassembly:
push esi
mov edi, dword [ecx + 0x6221e2dc]
dec esp
or eax, 0x7476ff00
mov eax, dword [esi]
xor al, ch
fdivp st(0)
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4ed1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esp, dword [eax + 0x148b5e98]
mov byte [eax + 0x60], 0x4c
xchg byte [ecx + ecx*4], cl
dec ebp
add bl, ch
xor eax, eax
add dword [ebx + 0x18838383], 0x49
dec eax
add cl, byte [ecx + 0x6060ff01]
mov edx, dword [ecx]
push esp
mov byte [eax + 0x60], 0x4c
xchg byte [ecx + ecx*4], cl
dec ebp
add bl, ch
xor eax, eax
add dword [ebx - 0x7c7c7c7d], 0xffffff83
add dword [ecx + eax*2], 0xffffffeb
add al, 0x41
jmp 0x4ed1ff
push ss
sbb dword [eax], 2
mov dword [eax], edx
add al, 0x40
dec ecx
sbb al, 0x50
push ecx
ja 0x4ed267
ret
into
call 0x156b146a
mov byte [edi + 0x15], dh
or byte [esi + 0x51], dh
inc dword [ecx + 0x1c]
adc eax, 0x8157788
jbe 0x4ed2c2
add byte [ebx - 0xdb5aba], cl
push edx
je 0x4ed265
mov byte [0x4c483], al
dec ebp
add bl, ch
add ecx, dword [ecx - 0xe74ebaa]
lea eax, [eax - 0x75]
inc esi
add dword [ecx - 0x75], esi
dec esi
sbb al, 0xe8
inc eax
jne 0x4ed297
dec esp
or byte [ebx - 0x7fef76ef], cl
or byte [edx + 0x10], ch
rol byte [ebx + 0x18838383], 0x41
dec esp
test eax, eax

Function at 0x4ed227
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add al, 0x41
jmp 0x4ed22f
mov dword [eax], edx
add al, 0x40
dec ecx
sbb al, 0x50
push ecx
ja 0x4ed297
ret
Function at 0x4ed2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x10
mov dword [ebx - 0x6d00aef0], ecx
sbb al, 0
push edx
and al, 0x8b
cmp dword [edi + 4], 0x689506a
mov eax, dword [esi + 0x1c]
adc eax, 0xc157788
pop esi
mov ecx, dword [ebx + ecx*4]
cmp dword [edi + 4], 0x8383c0ff
add dword [ebx - 0x7ab3bee8], 0xffffffc0
sbb byte [ecx + 0x4c], al
test eax, eax
sal byte [ebp + 0xd], 0xff
inc ecx
jne 0x4ed2db
inc dword [ecx + 0x1c]
sbb al, 0xff
adc eax, 0x517780
call dword [0x517780]
test al, 4
je 0x4ed29e
and al, 0xff
push edx
je 0x4ed2cb
bound edi, qword [eax - 0x40]
add dword [ebx + 0x41188383], 0x4c
sbb byte [ecx + 0x4c], al
test eax, eax
jne 0x4ed2fb
sal byte [ebp + 0xd], 0xff
inc ecx
sbb al, 0xff
invalid
in al, dx
xor byte [edi + 0x51], 0
test al, 4
je 0x4ed2be
inc dword [ecx + 0x1c]
and al, 0xff
push edx
je 0x4ed2eb
bound edi, qword [eax + eax*8 - 0x7d]
add dword [ebx + 0x4c411883], 0xffffff85
sal byte [ebp + 0x1b], 4
inc esp

Function at 0x50fc86
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x53
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc729008]
mov ecx, dword [edi + edx*2 + 0xf]
test ecx, ecx
sub edi, eax
mov ecx, dword [ebx - 0x7974e3b2]
sub al, 0x72
std
mov ebx, dword [0x8b5175c4]
call 0x1ddcfa15
les esi, [ebp + 0x51]
mov ecx, dword [eax]
lea ebx, [edi + 1]
push ecx
mov dword [esi + 0xc729014], eax
sbb eax, 0x8b5175c4
or byte [ebp - 0x76aefea1], cl
xchg byte [eax + edx*4], dl
jb 0x50fcbe
call ebx
mov edx, dword [esi - 0x3b7ce3ae]
or al, 2
mov eax, dword [eax + 0x70]
mov cx, word [eax + 0x1e]
jo 0x50fd26
mov ecx, dword [eax + 0x1e]
cmp cx, 0x8000
jae 0x50fce1
movzx edx, word [eax + 0x1c]
movzx eax, cx
sub eax, edx
cmp eax, 0xd6007fff
ja 0x50fce1
pop es
mov edi, 0x1c022968
lar esi, word [ebx]
dec dword [ebx + 0x6a571c4e]
add dword [ecx - 1], edx
rol dword [ebp + 0x545874ff], cl
xor edi, edi
mov ecx, dword [esi + 0x1c]
push edi
push 1
push ecx
call ebx
test edi, edi
je 0x50fd48
push esp
xchg byte [edx + 0x1c], dl
add esp, 0xffffff85
ror byte [ecx - 0xb87747a], 0x85
add byte [eax], dl
mov ecx, dword [edx + 0x70]
movzx edx, word [ecx - 7]
mov dword [eax], ebx
jo 0x50fd1f
or al, 0xc0
mov ecx, dword [eax + 0x70]
movzx edx, word [ecx + 0x1e]
push edi
jge 0x50fca2
jge 0x50fc9e
push eax
inc esi
out 0x9f, al
invalid
mov dword [eax], ebx
jo 0x50fd47
jo 0x50fd69
and al, 0x28
nop
jb 0x50fd36
sub byte [eax - 0x17dbf38e], dl
and al, 0xe8
push edx
cmp ebp, 0xc6bc240c
adc al, 0x40
dec esp
jbe 0x50fd44
and al, 0xbc
invalid
jp 0x50fcd9
std
les edx, [eax]
xchg byte [eax], dl
add byte [eax - 0x6ffe95c5], dl
adc byte [esi + 0x3b900010], al
push 1
nop
dec eax
push 0xffffffffffffffe8
invalid
call dword [0xc614010d]
invalid