joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a71a
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
mov eax, 0x7f7a28
call fcn.007eae2c
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0049a12a
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov eax, dword [ebp + 8]
mov dword [esi], 0x8800ec
mov dword [esi + 8], 0x8800d8
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
call fcn.0042cf58
mov dword [esi + 0x50], eax
mov byte [ebp - 4], 3
call fcn.0042cf58
mov dword [esi + 0x54], eax
mov byte [ebp - 4], 4
lea edi, [esi + 0x58]
xor eax, eax
lea ecx, [esi + 0x64]
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x14], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042b90d
mov dword [esi + 0x68], ebx
mov byte [ebp - 4], 6
lea ecx, [esi + 0x6c]
mov dword [ecx], ebx
push dword [0x94961c]
call fcn.00439af8
mov byte [ebp - 4], 7
lea ecx, [esi + 0x70]
mov dword [ecx], ebx
push dword [0x949618]
call fcn.0041c22b
mov byte [ebp - 4], 8
lea ecx, [esi + 0x74]
mov dword [ecx], ebx
push dword [0x949618]
call fcn.0041c22b
mov byte [ebp - 4], 9
lea ecx, [esi + 0x78]
mov dword [ecx], ebx
push dword [0x949618]
call fcn.0041c22b
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x495fa8
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x7f8de9
call fcn.007eae2c
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x872a48
mov dword [esi + 4], ecx
mov al, byte [ebp + 8]
mov dword [ebp - 4], ecx
mov byte [esi + 8], al
mov al, byte [ebp + 0xc]
mov dword [esi], 0x87ffcc
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0x64
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov byte [esi + 0x3c], cl
mov dword [esi + 0x40], ecx
or dword [esi + 0x4c], 0xffffffff
or dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov byte [esi + 0x54], al
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], ecx
mov byte [ebp - 4], 7
or dword [esi + 0x78], 0xffffffff
mov byte [esi + 0x74], cl
mov byte [esi + 0x7c], cl
call fcn.0042d734
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x495fb3
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x7f8de9
call fcn.007eae2c
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x872a48
mov dword [esi + 4], ecx
mov al, byte [ebp + 8]
mov dword [ebp - 4], ecx
mov byte [esi + 8], al
mov al, byte [ebp + 0xc]
mov dword [esi], 0x87ffcc
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0x64
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov byte [esi + 0x3c], cl
mov dword [esi + 0x40], ecx
or dword [esi + 0x4c], 0xffffffff
or dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov byte [esi + 0x54], al
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], ecx
mov byte [ebp - 4], 7
or dword [esi + 0x78], 0xffffffff
mov byte [esi + 0x74], cl
mov byte [esi + 0x7c], cl
call fcn.0042d734
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4983af
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x7f928c
call fcn.007eae2c
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], ebx
push dword [esi]
call fcn.004411e4
mov dword [ebp - 4], ebx
lea ecx, [edi + 4]
mov dword [ecx], ebx
push dword [esi + 4]
call fcn.004411e4
mov byte [ebp - 4], 1
lea ecx, [edi + 8]
mov dword [ecx], ebx
push dword [esi + 8]
call fcn.004411e4
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
mov dword [ecx], ebx
push dword [esi + 0xc]
call fcn.004411e4
mov byte [ebp - 4], 3
lea ecx, [edi + 0x10]
mov dword [ecx], ebx
push dword [esi + 0x10]
call fcn.004411e4
mov byte [ebp - 4], 4
lea ecx, [edi + 0x14]
mov dword [ecx], ebx
push dword [esi + 0x14]
call fcn.004411e4
mov byte [ebp - 4], 5
lea ecx, [edi + 0x18]
mov dword [ecx], ebx
push dword [esi + 0x18]
call fcn.004411e4
mov byte [ebp - 4], 6
lea ecx, [edi + 0x1c]
mov dword [ecx], ebx
push dword [esi + 0x1c]
call fcn.004411e4
mov byte [ebp - 4], 7
lea ecx, [edi + 0x20]
mov dword [ecx], ebx
push dword [esi + 0x20]
call fcn.004411e4
mov byte [ebp - 4], 8
lea ecx, [edi + 0x24]
mov dword [ecx], ebx
push dword [esi + 0x24]
call fcn.004411e4
mov byte [ebp - 4], 9
lea ecx, [edi + 0x28]
mov dword [ecx], ebx
push dword [esi + 0x28]
call fcn.004411e4
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0x2c]
mov dword [ecx], ebx
push dword [esi + 0x2c]
call fcn.004411e4
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x30]
mov dword [ecx], ebx
push dword [esi + 0x30]
call fcn.004411e4
mov byte [ebp - 4], 0xc
lea ecx, [edi + 0x34]
mov dword [ecx], ebx
push dword [esi + 0x34]
call fcn.004411e4
mov byte [ebp - 4], 0xd
lea ecx, [edi + 0x38]
mov dword [ecx], ebx
push dword [esi + 0x38]
call fcn.004411e4
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x3c]
mov dword [ecx], ebx
push dword [esi + 0x3c]
call fcn.004411e4
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x40]
mov dword [ecx], ebx
push dword [esi + 0x40]
call fcn.004411e4
mov byte [ebp - 4], 0x10
lea ecx, [edi + 0x44]
mov dword [ecx], ebx
push dword [esi + 0x44]
call fcn.004411e4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4b7fb3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x7fb1b2
call fcn.007eae2c
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x14]
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [esi + 0x2c], ecx
lea ecx, [edx + 0x3c]
mov dword [esi + 0x30], eax
call fcn.0042b03d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x4b9751
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x7fb3d1
call fcn.007eae2c
push ecx
push ecx
push ebx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], ebx
push esi
push edi
mov dword [ebx], 0x872a48
mov dword [ebx + 4], eax
mov dword [ebp - 4], eax
lea esi, [ebx + 8]
mov dword [ebx], 0x883e98
mov dword [ebp - 0x14], esi
mov dword [esi], 0x883ec4
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
push 0x90
mov dword [esi + 4], 0x24
call fcn.007965bb
mov edi, eax
add esi, 8
pop ecx
mov dword [esi], edi
lea eax, [edi + 0x8c]
cmp edi, esi
ja 0x4b97c9
cmp eax, esi
jb 0x4b97c9
xor edi, edi
mov ecx, edi
mov eax, dword [esi]
mov dword [ecx + eax], edi
add ecx, 4
cmp ecx, 0x90
jb 0x4b97b7
jmp 0x4b97d2
push 0x24
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov dword [ebp - 0x14], esi
call fcn.0042d734
mov dword [esi], eax
mov byte [ebp - 4], 3
call fcn.0042d734
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, ebx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x58], edi
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x64], edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4b990c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7fb434
call fcn.007eae2c
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x872a48
mov dword [edi + 4], ebx
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov dword [ebp - 4], ebx
mov dword [edi], 0x883f48
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00477d0a
mov byte [ebp - 4], 1
lea ecx, [edi + 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push dword [esi + 0x18]
push dword [esi + 0x14]
call fcn.00477d0a
mov byte [ebp - 4], 2
lea ecx, [edi + 0x1c]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.00477d0a
mov byte [ebp - 4], 3
lea ecx, [edi + 0x24]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push dword [esi + 0x28]
push dword [esi + 0x24]
call fcn.00477d0a
lea eax, [esi + 0x30]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x30]
call fcn.00444292
lea ecx, [edi + 0x38]
mov dword [ecx], ebx
push dword [esi + 0x38]
call fcn.00439af8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4cc330
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7fc44d
call fcn.007eae2c
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x872a48
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi], 0x884b3c
call fcn.0042d734
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
call fcn.0042cf58
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 2
mov dword [esi + 0x14], ebx
call fcn.0042d734
mov dword [esi + 0x18], eax
mov byte [ebp - 4], 3
call fcn.0042cf58
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov byte [ebp - 4], 5
call fcn.0042d734
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
push ebx
mov dword [ecx], ebx
call fcn.00439af8
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 7
push ebx
mov dword [ecx], ebx
call fcn.00439af8
mov byte [ebp - 4], 8
mov byte [esi + 0x38], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov word [esi + 0x54], bx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], 0x80000000
mov byte [esi + 0x64], bl
call fcn.0042cf58
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 9
call fcn.0042cf58
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x6c], eax
mov eax, esi
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4fd9e9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7ffb66
call fcn.007eae2c
push ecx
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [esi + 4], 0x8882ec
mov dword [esi + 0x44], 0x8882fc
mov dword [esi + 0x58], 0x888304
mov dword [esi + 0x34], 0x872a48
mov dword [esi + 0x38], edi
push ecx
mov dword [ebp - 4], edi
lea ecx, [esi + 0x40]
mov dword [ebp - 0x10], 1
call fcn.0042d888
push ecx
lea ecx, [esi + 0x54]
call fcn.004725a6
mov eax, dword [esi + 4]
mov dword [esi], 0x888310
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x8881ac
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov dword [eax + esi + 4], 0x8881d4
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 4], 0x8882c4
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
lea eax, [ecx - 0x3c]
mov dword [ecx + esi], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x50]
mov dword [ecx + esi], eax
mov eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], 0xff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x52d77e
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x803892
call fcn.007eae2c
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [esi + 4], 0x88db54
mov dword [esi + 0x44], 0x872a48
mov dword [esi + 0x48], edi
xor ebx, ebx
mov dword [ebp - 4], edi
inc ebx
push ecx
mov dword [ebp - 0x10], ebx
call fcn.0042d888
mov dword [ebp - 4], ebx
mov eax, dword [esi + 4]
mov dword [esi], 0x88db60
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x88db30
mov dword [esi + 0x10], edi
mov byte [ebp - 4], 2
call fcn.0042cf58
mov dword [esi + 0x14], eax
xor ecx, ecx
mov dword [esi + 0x18], ecx
mov eax, 0x2022
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
or dword [esi + 0x30], 0xffffffff
mov word [esi + 0x28], ax
mov eax, 0x80000000
mov byte [esi + 0x2a], cl
mov byte [esi + 0x2b], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], 0x64
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x5847e9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7f2ffa
call fcn.007eae2c
sub esp, 0x110
push ebx
push esi
push edi
push 0x14
mov dword [ebp - 0x14], ecx
call fcn.00795dab
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], ebx
mov edi, ebx
add esi, 8
pop ecx
lea ecx, [ebx + 8]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], 0x872a48
xor edi, edi
mov dword [ebx + 4], edi
mov dword [ecx], edi
mov dword [ebx], 0x893224
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
call fcn.00443594
push ebx
mov ecx, esi
call fcn.004770a2
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp + 8], ebx
call dword [eax + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5848d3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test al, al
jne 0x58486b
push str.pt__is_text__
jmp 0x5848d8
push edi
lea ecx, [ebx + 0xc]
call fcn.004770a2
lea esi, [edi + 0x30]
push esi
lea ecx, [ebx + 0x10]
call fcn.00433bd0
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00429da5
lea esi, [edi + 0x10]
mov ecx, esi
call fcn.0042d6c2
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
mov edx, dword [eax]
call dword [edx + 0x31c]
push 4
mov ecx, esi
call fcn.0042d6c2
push eax
mov ecx, edi
call fcn.004bc209
mov dword [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x893030
lea ecx, [ebp - 0x118]
call fcn.00499f82
push 0x91f71c
lea eax, [ebp - 0x118]
push eax
call fcn.007975a0
int3
Function at 0x599680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x80928e
call fcn.007eae2c
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x38
mov dword [esi + 4], ebx
call fcn.00404200
pop ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [eax + 0x10], ecx
test ecx, ecx
je 0x5996ab
inc dword [ecx]
mov dword [eax + 0x24], ebx
mov dword [eax + 0x34], ebx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
mov byte [eax + 0xc], bl
mov eax, dword [esi + 4]
mov byte [eax + 0xd], bl
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x5a2277
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [ecx + 4]
imul edx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
push ebp
push esi
add edx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [eax + edx*4]
mov eax, 0xff
lea ebp, [edi + 3]
sub edi, ebx
movzx ecx, byte [ebp]
mov esi, eax
movzx eax, byte [ebp - 1]
sub esi, ecx
imul eax, ecx
xor edx, edx
movzx ecx, byte [ebx + 2]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
xor edx, edx
mov byte [ebx + 2], al
movzx ecx, byte [ebp]
movzx eax, byte [ebp - 2]
imul eax, ecx
movzx ecx, byte [ebx + 1]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
xor edx, edx
mov byte [ebx + 1], al
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
movzx eax, byte [edi + ebx]
imul eax, ecx
movzx ecx, byte [ebx]
imul ecx, esi
add eax, ecx
mov ecx, 0xff
div ecx
movzx ecx, byte [ebx + 3]
xor edx, edx
mov byte [ebx], al
mov eax, 0xff
sub eax, ecx
lea ebx, [ebx + 4]
imul eax, esi
mov ecx, 0xff
div ecx
sub dword [esp + 0x20], 1
not al
mov byte [ebx - 1], al
mov eax, ecx
jne 0x5a229a
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x5caf70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
mov ebx, ecx
push ebp
push esi
mov dword [ebx], 0
lea ebp, [ebx + 8]
mov dword [ebx + 4], 0
mov esi, ebp
test edx, edx
je 0x5cafaf
movzx eax, word [edx]
test ax, ax
je 0x5cafaf
sub edx, ebp
nop word [eax + eax]
mov word [esi], ax
add esi, 2
movzx eax, word [edx + esi]
test ax, ax
jne 0x5cafa0
mov eax, dword [esp + 0x14]
cdq
shr dword [esp + 0x14], 0x1f
mov ecx, eax
xor ecx, edx
mov dword [esp + 0xc], esi
sub ecx, edx
mov byte [esp + 0x1c], 0
mov eax, 0x66666667
imul ecx
push edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
lea eax, [edi + edi*4]
add eax, eax
sub ecx, eax
je 0x5caff6
movsx ax, byte [ecx + str.0123456789]
mov byte [esp + 0x20], 1
mov word [esi], ax
add esi, 2
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx*4]
add eax, eax
sub edi, eax
cmp byte [esp + 0x20], 0
jne 0x5cb01e
test edi, edi
je 0x5cb02c
mov byte [esp + 0x20], 1
movsx ax, byte [edi + str.0123456789]
mov word [esi], ax
add esi, 2
mov eax, 0x66666667
imul ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dl, byte [esp + 0x20]
lea eax, [edi + edi*4]
add eax, eax
sub ecx, eax
test dl, dl
jne 0x5cb052
test ecx, ecx
je 0x5cb060
mov dl, 1
movsx ax, byte [ecx + str.0123456789]
mov word [esi], ax
add esi, 2
test dl, dl
je 0x5cb070
mov eax, 0x2e
mov word [esi], ax
add esi, 2
nop
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx*4]
add eax, eax
sub edi, eax
movsx ax, byte [edi + str.0123456789]
mov edi, ecx
mov word [esi], ax
add esi, 2
test edi, edi
jg 0x5cb070
cmp byte [esp + 0x18], 0
pop edi
je 0x5cb0af
mov eax, 0x2d
mov word [esi], ax
add esi, 2
push esi
push dword [esp + 0x10]
xor eax, eax
mov word [esi], ax
call fcn.007e3fd9
mov ecx, dword [esp + 0x28]
add esp, 8
test ecx, ecx
je 0x5cb0e6
movzx eax, word [ecx]
test ax, ax
je 0x5cb0e6
mov edx, eax
mov word [esi], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx]
add esi, 2
mov edx, eax
test ax, ax
jne 0x5cb0d3
xor eax, eax
mov word [esi], ax
sub esi, ebx
sub esi, 8
mov dword [ebx], ebp
sar esi, 1
mov eax, ebx
mov dword [ebx + 4], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x5d7d32
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7ff224
call fcn.007eae2c
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
push ebx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x14]
call fcn.0042b6bf
xor esi, esi
cmp dword [ebx], 0xf
jne 0x5d7d5f
mov eax, dword [ebx + 8]
jmp 0x5d7d61
mov eax, esi
mov edx, dword [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 0x30]
lea eax, [ecx + 0xc]
neg ecx
sbb ecx, ecx
and ecx, eax
add ecx, edx
mov al, byte [ecx + 1]
mov byte [ebp + 0xc], al
mov al, byte [ecx + 2]
mov byte [ebp + 0xd], al
mov al, byte [ecx + 3]
add ecx, 4
mov byte [ebp + 0xe], al
push ecx
push dword [edi + 4]
mov al, byte [ecx]
lea ecx, [ebp - 0x24]
mov byte [ebp + 0xf], al
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], ebx
cmovb ebx, dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
call fcn.004b81c2
lea ecx, [edi + 0xc]
mov dword [ebp - 4], esi
push eax
mov dword [ebp + 0x10], ecx
call fcn.0045a4c7
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.0042b7b3
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x5d7dee
mov edi, dword [ebp + 0x14]
mov esi, ebx
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, ebx
call fcn.0045a4c7
add edi, 0x10
sub esi, 1
jne 0x5d7dd8
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
inc ebx
test ecx, ecx
je 0x5d7e01
mov eax, dword [ecx + 4]
lea esi, [ecx + 0xc]
shl eax, 4
add esi, eax
mov eax, ebx
mov dword [edi + 0x2c], ebx
shl eax, 4
sub esi, eax
mov eax, dword [edi]
mov dword [edi + 0x28], esi
mov ecx, dword [eax + 0x30]
lea eax, [ecx + 0xc]
neg ecx
sbb ecx, ecx
and ecx, eax
add ecx, dword [ebp - 0x14]
push ecx
mov ecx, edi
call fcn.005d63a2
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x14]
push eax
call fcn.0042b76b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x5dd690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.005dd4d0
mov ecx, dword [ebp + 8]
lea edx, [esp + 4]
add esp, 4
call fcn.005dd560
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x72ef30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x72ef9a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x72ef50
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x72efa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x72f013
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x72efc0
pop edi
pop esi
pop ebx
pop ebp
ret