joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c702
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0xd38f6c], 0
jne 0x49c7ab
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x49
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x44
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x67
mov byte [ebp - 0x1d], 0x67
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x50
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [0x4ea354]
push eax
call dword [0x4ea358]
mov dword [0xd38f6c], eax
cmp dword [0xd38f6c], 0
je 0x49c7bc
call dword [0xd38f6c]
jmp 0x49c7be
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49cf53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0xd38f74], 0
jne 0x49cff8
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x67
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x42
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x78
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [0x4ea354]
push eax
call dword [0x4ea358]
mov dword [0xd38f74], eax
cmp dword [0xd38f74], 0
je 0x49d019
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0x40
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [0xd38f74]
mov esp, ebp
pop ebp
ret

Function at 0x49d3b7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [0x4ea198]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xac4], eax
mov dword [ebp - 4], 0
jmp 0x49d3e9
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 8
jae 0x49d413
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x49d4dc
push 0
push 0
call fcn.004bcd28
add esp, 0x18
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x49d3e0
mov esp, ebp
pop ebp
ret
Function at 0x49e46f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6f47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push edi
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], 0
mov byte [ebp - 0x12c], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x80
mov eax, dword [ebp - 0x158]
add eax, 0x148
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.004bb9a0
add esp, 0xc
push 0x80
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.004bccd0
add esp, 0xc
mov byte [ebp - 0x2c], 0x43
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x79
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x55
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x34
mov byte [ebp - 0x24], 0x76
mov byte [ebp - 0x23], 0x53
mov byte [ebp - 0x22], 0x50
mov byte [ebp - 0x21], 0x39
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x45
mov byte [ebp - 0x1d], 0x33
mov byte [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x12c]
push eax
push 0x80
mov ecx, dword [ebp - 0x158]
add ecx, 0x148
push ecx
mov ecx, dword [ebp - 0x158]
call fcn.0049d62f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2c]
push edx
push 3
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax + 0xac4]
push ecx
lea ecx, [ebp - 0x148]
call fcn.004a8740
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.004a87e0
push 0
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004a00b6
add esp, 0x10
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x12c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004bbce0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], 2
jge 0x49e5f9
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
shl eax, 8
mov ecx, dword [ebp - 0x158]
lea edx, [ecx + eax + 0x4bc]
push edx
call fcn.004bb9a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x130]
jne 0x49e656
cmp dword [ebp + 0x10], 0
je 0x49e621
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004bb9a0
add esp, 0xc
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0049bfc0
mov eax, dword [ebp - 0x154]
or al, 1
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x148]
call fcn.004a87a0
mov eax, dword [ebp + 8]
jmp 0x49e6b3
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x130]
add ecx, 1
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x130], 4
jl 0x49e5bd
lea edx, [ebp - 0x150]
push edx
push 0xd39f88
mov ecx, dword [ebp + 8]
call fcn.0049bfc0
mov eax, dword [ebp - 0x154]
or al, 1
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x148]
call fcn.004a87a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a072b
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0x9e3779b9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], 0
jmp 0x4a0785
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jae 0x4a07de
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x24]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x24]
xor ecx, edx
mov eax, dword [ebp - 0xc]
shr eax, 5
add eax, dword [ebp - 0x10]
xor ecx, eax
mov edx, dword [ebp - 0x18]
add edx, ecx
mov dword [ebp - 0x18], edx
jmp 0x4a077c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x4a07f3
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0xc6ef3720
mov dword [ebp - 8], 0x9e3779b9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], 0
jmp 0x4a084d
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jae 0x4a08a6
mov ecx, dword [ebp - 0xc]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x24]
xor ecx, edx
mov eax, dword [ebp - 0xc]
shr eax, 5
add eax, dword [ebp - 0x10]
xor ecx, eax
mov edx, dword [ebp - 0x18]
sub edx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
shl eax, 4
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
xor eax, ecx
mov edx, dword [ebp - 0x18]
shr edx, 5
add edx, dword [ebp - 0x14]
xor eax, edx
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x24], edx
jmp 0x4a0844
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x4a08bb
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0x9e3779b9
mov dword [ebp - 0x10], 0
jmp 0x4a08f3
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x20
jae 0x4a095b
mov edx, dword [ebp - 0xc]
shl edx, 4
mov eax, dword [ebp - 0xc]
shr eax, 5
xor edx, eax
add edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
and ecx, 3
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
add esi, dword [eax + ecx*4]
xor edx, esi
mov ecx, dword [ebp - 8]
add ecx, edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp - 8]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
shr edx, 0xb
and edx, 3
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
add esi, dword [ecx + edx*4]
xor eax, esi
mov edx, dword [ebp - 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
jmp 0x4a08ea
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0971
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x9e3779b9
mov ecx, dword [ebp - 4]
shl ecx, 5
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
jmp 0x4a09ab
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x20
jae 0x4a0a13
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp - 8]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
shr edx, 0xb
and edx, 3
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
add esi, dword [ecx + edx*4]
xor eax, esi
mov edx, dword [ebp - 0xc]
sub edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 4
mov edx, dword [ebp - 0xc]
shr edx, 5
xor ecx, edx
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
and eax, 3
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
add esi, dword [edx + eax*4]
xor ecx, esi
mov eax, dword [ebp - 8]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x4a09a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0a29
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x61c88647
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
shr eax, 2
and eax, 3
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x4a0a71
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 1
jae 0x4a0ae0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4 + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
shr edx, 5
mov eax, dword [ebp - 0xc]
shl eax, 2
xor edx, eax
mov ecx, dword [ebp - 0xc]
shr ecx, 3
mov eax, dword [ebp - 0x18]
shl eax, 4
xor ecx, eax
add edx, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
and eax, 3
xor eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + eax*4]
xor eax, dword [ebp - 0x18]
add ecx, eax
xor edx, ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
add ecx, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x18], eax
jmp 0x4a0a68
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
shr eax, 5
mov ecx, dword [ebp - 0xc]
shl ecx, 2
xor eax, ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov ecx, dword [ebp - 0x18]
shl ecx, 4
xor edx, ecx
add eax, edx
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
and ecx, 3
xor ecx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + ecx*4]
xor ecx, dword [ebp - 0x18]
add edx, ecx
xor eax, edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
add ecx, eax
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x4a0a47
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0b51
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x10], 0x20
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x9e3779b9
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
shr eax, 2
and eax, 3
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
jmp 0x4a0b91
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x4a0c00
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4 - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shr edx, 5
mov eax, dword [ebp - 0xc]
shl eax, 2
xor edx, eax
mov ecx, dword [ebp - 0xc]
shr ecx, 3
mov eax, dword [ebp - 0x18]
shl eax, 4
xor ecx, eax
add edx, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
and eax, 3
xor eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + eax*4]
xor eax, dword [ebp - 0x18]
add ecx, eax
xor edx, ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
sub ecx, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x4a0b88
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
shr eax, 5
mov ecx, dword [ebp - 0xc]
shl ecx, 2
xor eax, ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov ecx, dword [ebp - 0x18]
shl ecx, 4
xor edx, ecx
add eax, edx
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
and ecx, 3
xor ecx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + ecx*4]
xor ecx, dword [ebp - 0x18]
add edx, ecx
xor eax, edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
sub ecx, eax
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x61c88647
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a0b73
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a19cf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6fc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xc], 0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
call fcn.004a8a70
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x20
call fcn.004a8a70
mov byte [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.004a8a70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x40
call fcn.004a8a70
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
call fcn.004a26de
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a26de
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x4a26f9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4a275a
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x50], eax
jmp 0x4a2721
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 8
jge 0x4a2758
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4 + 0x50]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edx*4 + 0x50]
and edx, 1
neg edx
sbb edx, edx
and edx, 0xedb88320
xor ecx, edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [edx + eax*4 + 0x50], ecx
jmp 0x4a2718
jmp 0x4a26f0
mov esp, ebp
pop ebp
ret
Function at 0x4a8810
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004bbce0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 4]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jl 0x4a8836
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0xff
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0xc], al
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov byte [ecx], dl
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jl 0x4a8876
mov esp, ebp
pop ebp
ret
Function at 0x4afcdc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7633
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x130], 0
mov dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 0x30]
add ecx, 0x144
push ecx
call dword [0x4ea1a4]
test eax, eax
jne 0x4afdac
call dword [0x4ea364]
mov dword [ebp - 0x14], eax
push 0xd14ddc
call fcn.0049d16f
add esp, 4
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x134]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.004ad6e4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4afd9d
cmp dword [0xd39fd4], 0
jne 0x4afd9d
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x134]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.004ad6e4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4afd7f
jmp 0x4afd9d
push 0x64
call fcn.0049c6d0
add esp, 4
call dword [0x4ea364]
sub eax, dword [ebp - 0x14]
cmp eax, 0x7530
jbe 0x4afd9b
jmp 0x4afd9d
jmp 0x4afd59
push 0xd14df0
call fcn.0049d16f
add esp, 4
jmp 0x4afdb1
jmp 0x4afecd
cmp dword [ebp - 0x10], 0
je 0x4afea8
cmp dword [0xd38f58], 0
jne 0x4afe3d
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x2320], 0
je 0x4afdec
push 0xd14cc8
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x2328
push ecx
mov edx, dword [ebp - 0x30]
call dword [edx + 0x2320]
jmp 0x4afe3d
push 0xd14e00
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.004af470
mov dword [ebp - 4], 0
push 0x1388
push 0xd14e04
lea ecx, [ebp - 0x24]
call fcn.004a8b70
push eax
mov ecx, 0xd3acf0
call fcn.004b30eb
push eax
call fcn.0049cf53
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0049bff0
cmp dword [0xd3ee30], 0
je 0x4afe7b
mov edx, dword [0xd3ee30]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4afe6a
push 1
mov ecx, dword [ebp - 0x28]
call fcn.004b2450
mov dword [ebp - 0x34], eax
jmp 0x4afe71
mov dword [ebp - 0x34], 0
mov dword [0xd3ee30], 0
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x144
push ecx
call dword [0x4ea1a4]
cmp dword [0xd14894], 0
je 0x4afea6
cmp dword [0xd38f58], 0
jne 0x4afea6
push 0
call fcn.004bd360
jmp 0x4afebc
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x138], 1
jne 0x4afebc
mov ecx, dword [ebp - 0x30]
call fcn.004af057
push 0
mov eax, dword [ebp - 0x30]
add eax, 0x144
push eax
call dword [0x4ea1a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret