joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x48
call fcn.00628320
mov eax, dword [0x70c514]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], eax
mov dl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
push edi
lea edi, [esi + 0x10]
test dl, 0x40
jne 0x4903b5
push eax
push edi
push esi
call ecx
mov dl, byte [ebp - 0x1d]
add esp, 0xc
movzx eax, dl
xor ecx, ecx
and eax, 7
mov edx, 0xf
sub edx, eax
mov byte [esi], al
mov dword [ebp - 0x44], edx
cmp edx, 0xf
jae 0x4903e3
nop
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x4903d0
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x490405
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006281fa
mov esp, ebp
pop ebp
ret
mov eax, ebx
shr eax, 4
mov dword [ebp - 0x38], eax
test eax, eax
je 0x490441
push edi
push esi
push dword [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
add esp, 0x18
shl eax, 4
add dword [ebp - 0x24], eax
add dword [ebp - 0x28], eax
sub ebx, eax
je 0x4904a2
shr eax, 4
mov ecx, esi
mov edx, eax
call fcn.00490010
jmp 0x490453
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, ebx
test eax, eax
je 0x4904a2
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [ebp - 0x30]
add esp, 0xc
test ebx, ebx
je 0x49048f
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, ecx
sub esi, eax
sub edx, eax
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edi, [edi + 1]
mov byte [edx + ecx - 1], al
xor byte [edi - 1], al
sub ebx, 1
jne 0x490474
mov esi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
lea eax, [esi + 0x10]
mov edi, dword [ebp - 0x30]
push ebx
push eax
push eax
call edi
add esp, 0xc
jmp 0x4904a8
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jae 0x4904c6
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.0062b450
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
mov eax, dword [ebp - 0x1c]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 8]
pop edi
mov byte [esi], al
xor ecx, ebp
pop esi
xor eax, eax
pop ebx
call fcn.006281fa
mov esp, ebp
pop ebp
ret
Function at 0x490550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.00628320
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test esi, esi
je 0x49070e
push edi
cmp esi, 0x10
jb 0x4905f0
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 8]
mov eax, ecx
sub edi, ecx
mov edx, 4
mov ecx, ebx
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov esi, ecx
nop dword [eax]
mov ecx, dword [edi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [esi + eax - 4], ecx
sub edx, 1
jne 0x4905a0
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [ebp - 4]
sub esi, 0x10
mov dword [ebp - 8], ebx
add ecx, 0x10
add esp, 0xc
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
sub dword [ebp - 0xc], 1
mov edx, esi
jne 0x490583
mov dword [ebp - 8], eax
mov dword [ebp + 8], edx
mov dword [ebp - 4], ecx
test edx, edx
je 0x490700
mov esi, eax
mov dword [ebp - 0xc], eax
sub esi, dword [ebp - 4]
lea edi, [ebx + 2]
mov dword [ebp - 0x18], esi
xor edx, edx
mov esi, ebx
inc ecx
sub esi, dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov esi, 1
sub esi, dword [ebp - 4]
mov dword [ebp - 0x20], esi
mov esi, 2
sub esi, dword [ebp - 4]
sub dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], esi
mov esi, ebx
not esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
nop dword [eax]
cmp edx, esi
jae 0x4906af
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, eax
mov al, byte [ecx - 1]
xor al, byte [esi]
mov esi, dword [ebp + 8]
mov byte [edi - 2], al
mov eax, dword [ebp - 0x14]
add eax, edi
cmp eax, esi
jae 0x4906a9
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov al, byte [ecx + eax]
xor al, byte [ecx]
mov byte [ecx + esi], al
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
add eax, ecx
cmp eax, esi
jae 0x4906a4
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edi]
xor al, byte [ecx + 1]
mov byte [edi], al
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, esi
jae 0x49069f
mov esi, dword [ebp - 0x10]
add edx, 4
mov al, byte [ecx + 2]
add ecx, 4
xor al, byte [esi + 3]
mov esi, dword [ebp + 8]
mov byte [edi + 1], al
add edi, 4
mov eax, dword [ebp - 8]
cmp edx, 0x10
jb 0x490630
jmp 0x4906d1
add edx, 3
jmp 0x4906aa
add edx, 2
jmp 0x4906aa
inc edx
cmp edx, 0x10
jae 0x4906d1
mov esi, dword [ebp - 0xc]
lea ecx, [edx + ebx]
mov edi, 0x10
sub edi, edx
nop dword [eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edi, 1
jne 0x4906c0
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
add esp, 0xc
mov eax, ebx
mov dword [ebp - 8], eax
cmp esi, 0x10
jbe 0x490700
mov ecx, dword [ebp - 4]
sub esi, 0x10
add ecx, 0x10
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4905f0
mov ecx, dword [ebp + 0x10]
pop edi
cmp ecx, eax
je 0x49070e
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628320
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, dword [esi]
test esi, esi
je 0x490a6b
mov edx, dword [ebp + 0x10]
test edi, edi
je 0x490a6b
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and esi, 0xf
jne 0x490a54
cmp edi, 0x10
jb 0x490aed
mov edx, dword [ebp + 0x10]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x490aa3
mov edx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push edx
call dword [ebp + 0x18]
add esp, 0xc
cmp esi, 0x10
jae 0x490ad8
mov eax, dword [ebp + 0x10]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp + 8]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x490ac6
add dword [ebp + 8], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
sub dword [ebp - 8], 1
jne 0x490aa0
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x490b22
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push eax
call dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp - 4]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x490b10
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628320
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], ecx
mov edi, dword [edi]
test edi, edi
je 0x490edb
mov edx, dword [ebp + 0x14]
test esi, esi
je 0x490edb
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and edi, 0xf
jne 0x490ec4
cmp esi, 0x10
jb 0x490f57
mov edx, dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
xor edi, edi
mov dword [ebp - 8], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], edi
mov edi, ebx
mov dword [ebp + 8], eax
sub edi, edx
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x490f13
mov edx, dword [ebp + 0x14]
push dword [ebp + 0xc]
push edx
push dword [ebp + 0x10]
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
call fcn.00490e70
mov eax, dword [ebp + 0x14]
mov edx, 4
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x490f30
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
sub dword [ebp + 8], 1
jne 0x490f10
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x490f93
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
call fcn.00490e70
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x490f81
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00628320
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov edx, ecx
mov dword [ebp - 4], edx
mov edi, dword [edi]
mov dword [ebp - 0xc], edi
test edi, edi
je 0x49101a
mov ecx, dword [ebp + 0x14]
nop dword [eax]
test esi, esi
je 0x49101a
mov al, byte [edi + ecx]
dec esi
xor al, byte [edx]
inc edi
mov byte [ebx], al
inc edx
inc ebx
mov dword [ebp - 4], edx
and edi, 0xf
mov dword [ebp - 0xc], edi
jne 0x491000
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0xc]
bswap eax
mov dword [ebp + 8], eax
cmp esi, 0x10
jb 0x4910ac
mov edi, eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
shr ecx, 4
lea eax, [ecx + edi]
neg edi
cmp eax, ecx
cmovae edi, ecx
mov dword [ebp - 8], edi
xor edi, edi
push dword [ebp - 8]
cmp eax, ecx
push ebx
cmovae edi, eax
push edx
mov dword [ebp + 8], edi
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov eax, edi
add esp, 0x14
bswap eax
mov dword [ecx + 0xc], eax
test edi, edi
jne 0x49108f
mov edx, 0xc
mov eax, 1
mov edi, ecx
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x491077
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shl eax, 4
sub esi, eax
add edx, eax
add ebx, eax
mov dword [ebp - 4], edx
cmp esi, 0x10
jae 0x491030
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0xc]
test esi, esi
je 0x491102
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
push ecx
push dword [ebp + 0xc]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, 1
bswap eax
mov dword [ecx + 0xc], eax
jne 0x4910dc
call fcn.00490fa0
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
nop dword [eax + eax]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x4910f0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov cl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add ebx, esi
movzx eax, cl
and eax, 1
push edi
lea edi, [esi + edx]
test esi, esi
je 0x4920ce
nop dword [eax]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [ebp + 0xc]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x4920b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x492bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x70d5ac]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x492c1e
test ebx, ebx
jne 0x492c2c
push 0xc
mov dword [0x70d32c], ebx
call fcn.006324fd
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x492c2c
xorps xmm0, xmm0
movq qword [ebx], xmm0
push ebx
mov dword [ebx + 8], 0
push dword [0x70d5ac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x492c2c
push ebx
call fcn.0062edf7
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push dword [0x70d5ac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x493240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x493310
cmp dword [ebx], 0
je 0x493255
call fcn.004cbbe0
cmp dword [ebx + 4], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x4932a3
call ecx
push dword [0x715cf4]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x493297
push 0
push dword [0x715cf4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004814e0
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebx + 8], 0
je 0x493305
call ecx
push dword [0x716110]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x716110]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b64f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x71610c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x71610c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b64f0
push ebx
call fcn.0062edf7
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x496260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628320
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi + 4]
cmp eax, 0x1e
ja 0x49639e
test dword [eax*4 + 0x6a60f8], 0x2956
je 0x49639e
lea eax, [ebx + 8]
mov dword [ebx + 4], 0xc
push esi
push eax
mov dword [ebp - 0xc], eax
call fcn.004777b0
mov edi, eax
add esp, 8
mov dword [ebx], edi
cmp edi, 0xffffffff
je 0x4963b2
mov ebx, dword [ebx + 8]
mov ecx, ebx
test edi, edi
jle 0x4962ff
movzx eax, byte [ecx]
cmp eax, 0x80
jae 0x4962db
test byte [eax*2 + 0x6a5bb8], 8
je 0x4962db
dec edi
inc ecx
test edi, edi
jg 0x4962c1
test edi, edi
jle 0x4962ff
lea eax, [ecx - 1]
add eax, edi
movzx edx, byte [eax]
cmp edx, 0x80
jae 0x4962ff
test byte [edx*2 + 0x6a5bb8], 8
je 0x4962ff
dec edi
dec eax
test edi, edi
jg 0x4962e4
xor esi, esi
mov eax, ebx
test edi, edi
jle 0x49638b
nop dword [eax + eax]
mov dl, byte [ecx]
movzx eax, dl
mov byte [ebp - 1], dl
test eax, 0xffffff80
jne 0x49637d
cmp eax, 0x80
jae 0x496364
test byte [eax*2 + 0x6a5bb8], 8
je 0x49634c
mov byte [ebx], 0x20
movzx eax, byte [ecx + 1]
inc ecx
inc esi
cmp eax, 0x80
jae 0x496381
test byte [eax*2 + 0x6a5bb8], 8
jne 0x496333
jmp 0x496381
cmp eax, 0x80
jae 0x496364
test byte [eax*2 + 0x6a5bb8], 2
mov dword [ebp - 8], 1
jne 0x49636b
mov dword [ebp - 8], 0
mov al, dl
xor al, 0x20
cmp dword [ebp - 8], 0
movzx edx, al
movzx eax, byte [ebp - 1]
cmove edx, eax
inc ecx
mov byte [ebx], dl
inc esi
inc ebx
cmp esi, edi
jl 0x496310
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
sub ebx, eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], ebx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx + 4], eax
push dword [esi]
mov edx, dword [esi + 8]
call fcn.00475f90
add esp, 4
test eax, eax
jne 0x4963bb
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
and dword [ebx + 0xc], 0x80
mov eax, dword [esi + 0xc]
pop edi
and eax, 0xffffff7f
or dword [ebx + 0xc], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6160
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0047f300
mov edi, eax
test edi, edi
je 0x4b622a
mov edx, dword [esi + 0x14]
sub edx, dword [esi + 4]
cmp edi, edx
jbe 0x4b619f
push 0x30d
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_rand_rand_lib.c
push 0x7d
mov edx, 0x71
lea ecx, [edx - 0x4d]
call fcn.004818c0
add esp, 0xc
jmp 0x4b622a
cmp dword [esi], 0
jne 0x4b61b2
push 0x312
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_rand_rand_lib.c
push 0x44
jmp 0x4b618a
mov edx, edi
mov ecx, esi
call fcn.0047f1d0
test eax, eax
je 0x4b622a
mov eax, dword [esi + 4]
add eax, dword [esi]
je 0x4b622a
push 2
push edi
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ecx, dword [esi + 4]
test eax, eax
mov eax, dword [esi + 0x18]
cmove ebx, edi
sub eax, ecx
cmp ebx, eax
jbe 0x4b6202
mov edx, 0x72
push 0x331
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_rand_rand_lib.c
push 0x7d
lea ecx, [edx - 0x4e]
call fcn.004818c0
add esp, 0xc
jmp 0x4b6216
test ebx, ebx
je 0x4b6216
lea eax, [ecx + ebx]
mov dword [esi + 4], eax
lea eax, [ebx*8]
add dword [esi + 0x1c], eax
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jb 0x4b623a
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 0x10]
jb 0x4b623a
test eax, eax
jne 0x4b623e
mov ecx, dword [esi + 0x1c]
cmp ecx, dword [esi + 0x20]
jb 0x4b623a
mov eax, dword [esi + 4]
cmp eax, dword [esi + 0x10]
jae 0x4b623c
xor ecx, ecx
mov eax, ecx
pop edi
pop esi
pop ebx
ret

Function at 0x4b99f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.00628320
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test edi, edi
je 0x4b9a70
mov cl, byte [edi]
test cl, cl
je 0x4b9a70
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [ebp - 4]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [ebp - 4], eax
test cl, cl
jne 0x4b9a20
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4bd880
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628320
mov eax, dword [0x70c514]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 1
cmp esi, 0xffffffff
jne 0x4bd8d6
push 0x52
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x87
mov edx, 0x8a
lea ecx, [esi + 0x21]
call fcn.004818c0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006281fa
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 3
and eax, 1
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jns 0x4bd92e
push 0xc3
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
push eax
lea ecx, [edx - 3]
call fcn.004818c0
add esp, 0xc
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006281fa
mov esp, ebp
pop ebp
ret
jne 0x4bd91b
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4bd97b
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
push esi
call edi
test eax, eax
je 0x4bd97b
push 0x5c
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0xe
push eax
lea ecx, [edx - 0xc]
call fcn.004818c0
push 0x5d
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x89
jmp 0x4bda0e
test bl, 0x10
je 0x4bd9ba
push 4
lea eax, [ebp - 8]
push eax
push 1
push 6
push esi
call edi
test eax, eax
je 0x4bd9ba
push 0x65
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0xe
push eax
lea ecx, [edx - 0xc]
call fcn.004818c0
push 0x66
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x8a
jmp 0x4bda0e
mov edx, dword [ebp - 0x10]
mov edi, 0x10
mov eax, 0x1c
cmp word [edx], 2
cmove eax, edi
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4bda31
or ecx, eax
call fcn.004bdcd0
test eax, eax
jne 0x4bd91b
push 0x6e
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
push eax
mov ecx, edx
call fcn.004818c0
push 0x6f
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x67
mov edx, 0x8a
lea ecx, [edx - 0x6a]
call fcn.004818c0
add esp, 0x18
xor eax, eax
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006281fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.006281fa
mov esp, ebp
pop ebp
ret