joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493370
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560a00
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
push esi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x28], 0
je 0x493416
call fcn.0045b3b0
push 3
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.0045b920
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], str.EventSender.cpp
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x10], 0xa2
call fcn.00418540
mov edx, str.Event_Sender_already_initialized_for_Azure
lea ecx, [ebp - 0xb8]
call fcn.004185a0
lea ecx, [ebp - 0x60]
call fcn.00459e90
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.004f7d4c
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x2c], 0
jne 0x493537
push 0
push 0
push 0
push 0
push 0x5f4644
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x493537
lea eax, [esi + 0x28c]
mov dword [esi + 0x50], 0x3c
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x50]
lea eax, [esi + 0x8c]
mov dword [esi + 0x64], 0x100
mov dword [esi + 0x7c], eax
lea eax, [esi + 0x38]
mov dword [esi + 0x80], 0x100
cmp dword [eax + 0x14], 8
jb 0x493476
mov eax, dword [eax]
push ecx
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x493505
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0x158]
push ecx
mov ecx, eax
call fcn.0045b920
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], str.EventSender.cpp
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x10], 0xb5
call fcn.00418540
mov edx, str.WinHttpCrackUrl_failed_for_Azure:
lea ecx, [ebp - 0x158]
call fcn.004185a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x158]
call fcn.0043d580
lea ecx, [ebp - 0x100]
call fcn.00459e90
mov dword [ebp - 4], 4
lea eax, [ebp - 0x100]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
jmp 0x493591
cmp word [esi + 0x68], 0
jne 0x493521
cmp dword [esi + 0x5c], 2
mov eax, 0x50
mov ecx, 0x1bb
cmove eax, ecx
mov word [esi + 0x68], ax
mov byte [esi + 0x28], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.0045b920
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], str.EventSender.cpp
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x10], 0xa9
call fcn.00418540
mov edx, str.Unable_to_open_HTTP_session_for_Azure
lea ecx, [ebp - 0xb8]
call fcn.004185a0
lea ecx, [ebp - 0x60]
call fcn.00459e90
mov dword [ebp - 4], 3
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], vtable.std::ios_base.0
push eax
call fcn.004f7d4c
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49a340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [esp], ecx
mov ecx, edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x34], esi
lea edi, [ecx + 2]
mov dword [esp + 0xc], esi
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a380
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00417c00
cmp dword [esp + 0x24], 8
lea edi, [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edx, 0x811c9dc5
cmovae edi, dword [esp + 0x10]
xor ecx, ecx
add eax, eax
je 0x49a3d5
mov esi, eax
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x49a3c0
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [ecx + 4]
call fcn.0049b810
mov edi, dword [eax + 4]
test edi, edi
jne 0x49a3fa
mov edi, dword [esp + 8]
mov edi, dword [edi + 8]
lea ecx, [esp + 0x10]
call fcn.00417680
mov eax, dword [esp + 8]
cmp edi, dword [eax + 8]
je 0x49a421
lea ecx, [edi + 0x20]
push ecx
mov ecx, esi
call fcn.0041b1f0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xorps xmm0, xmm0
mov ecx, esi
push 0
movups xmmword [esi], xmm0
push 0x5e4c28
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00417c00
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x49a570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov ecx, edx
push esi
push edi
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
lea esi, [ecx + 2]
mov dword [esp + 0x24], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a5a5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00417c00
mov eax, dword [esp + 0x20]
lea esi, [esp + 0x10]
cmp dword [esp + 0x24], 8
mov edx, 0x811c9dc5
cmovae esi, dword [esp + 0x10]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x49a5f1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x49a5e0
mov edi, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [edi + 4]
call fcn.0049b810
mov esi, dword [eax + 4]
test esi, esi
jne 0x49a612
mov esi, dword [edi + 8]
lea ecx, [esp + 0x10]
call fcn.00417680
mov eax, edi
cmp esi, dword [eax + 8]
je 0x49a653
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49a630
sub eax, edx
lea ecx, [esi + 0x20]
sar eax, 1
push eax
push edi
call fcn.0041ba30
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x49a660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 4], ecx
mov ecx, edx
push esi
push edi
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
lea esi, [ecx + 2]
mov dword [esp + 0x24], 0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a690
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00417c00
mov eax, dword [esp + 0x20]
lea esi, [esp + 0x10]
cmp dword [esp + 0x24], 8
mov edx, 0x811c9dc5
cmovae esi, dword [esp + 0x10]
lea edi, [eax + eax]
xor eax, eax
test edi, edi
je 0x49a6e1
nop word [eax + eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, edi
jb 0x49a6d0
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [edi + 4]
call fcn.0049b810
mov esi, dword [eax + 4]
test esi, esi
jne 0x49a702
mov esi, dword [edi + 8]
lea ecx, [esp + 0x10]
call fcn.00417680
mov eax, edi
pop edi
cmp esi, dword [eax + 8]
pop esi
setne al
mov esp, ebp
pop ebp
ret 4
Function at 0x49b440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5612d5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edx
cmp dword [edx + 0x14], 8
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x18], edx
jb 0x49b487
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x49b4b7
mov edi, dword [ebp - 0x18]
mov edx, eax
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x49b4a0
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0049b810
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b4e7
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x49b61f
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x18], 0
call fcn.0050fd59
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp - 0x20]
lea ecx, [edi + 8]
call fcn.0049b890
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5f5580]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5f5580]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x49b5c1
divss xmm0, xmm3
call fcn.00487df0
call fcn.00510890
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x49b59f
cmp eax, 0x200
jae 0x49b59d
shl eax, 3
cmp eax, ecx
jae 0x49b59f
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0049b680
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0049b810
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
jmp 0x49b5c4
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x49b5ec
mov dword [ecx + eax*8], edi
jmp 0x49b5fe
cmp esi, edx
jne 0x49b5f5
mov dword [ecx + eax*8], edi
jmp 0x49b602
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x49b602
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004f78b7
int3
Function at 0x49b680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x49b7fa
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0049b2e0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x49b7d5
cmp dword [esi + 0x1c], 8
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jb 0x49b701
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0xc]
xor edx, edx
add ecx, ecx
mov ebx, 0x811c9dc5
mov dword [ebp - 0xc], ecx
je 0x49b72e
mov eax, dword [ebp - 4]
mov edi, ecx
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x49b717
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x49b74d
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x49b7cb
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.00489ec0
test al, al
jne 0x49b787
mov ebx, dword [ebx]
cmp ebx, esi
je 0x49b77f
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x49b7c8
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x49b7ab
nop
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.00489ec0
test al, al
je 0x49b7de
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x49b790
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x49b6e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x49b7c8
push str.invalid_hash_bucket_count
call fcn.004f78b7
int3
Function at 0x49c200
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp - 0x24]
mov esi, ecx
push eax
push 0
push 0x40000001
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], esi
push edi
mov dword [ebp - 0x24], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x49c266
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.00441940
cmp dword [ebp - 0xc], 0x10
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
push 0x40000001
push dword [ebp + 8]
push edi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x49c2c8
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
call fcn.004173e0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x49c2fe
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edi, dword [ebp - 0x20]
cmp edx, 0x10
cmovae eax, edi
cmp byte [ecx + eax - 1], 0
jne 0x49c2fe
dec ecx
lea eax, [ebp - 0x20]
cmp edx, 0x10
mov dword [ebp - 0x10], ecx
cmovae eax, edi
mov byte [eax + ecx], 0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x49c2d0
mov ecx, dword [ebp - 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, esi
movups xmm0, xmmword [ebp - 0x20]
mov dword [esi + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [esi + 0x10], xmm0
pop esi
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret

Function at 0x49ce20
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x604ca8
push 0x557305
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x38], esi
mov eax, dword [edx + 0xc]
push dword [eax]
mov eax, dword [edx + 8]
push dword [eax]
mov ecx, dword [edx + 4]
push dword [ecx]
mov ecx, dword [edx]
push dword [ecx]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov edx, eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5490
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor esi, edi
rol esi, 4
bswap esi
cmp ecx, 0xc
jbe 0x4a5510
mov eax, dword [esp + 0xc]
add ecx, 0xfffffff4
push ebx
push ebp
mov ebp, dword [esp + 0x20]
add ecx, ebp
mov dword [esp + 0x1c], ecx
mov ebx, ecx
nop
add esi, dword [ebx + 4]
add edi, dword [ebx + 8]
mov edx, esi
add eax, dword [ebx]
xor edi, esi
rol edx, 0xe
mov ebx, ebp
sub edi, edx
add ebp, 0xc
mov ecx, edi
xor eax, edi
rol ecx, 0xb
sub eax, ecx
mov edx, eax
xor esi, eax
ror edx, 7
sub esi, edx
cmp ebx, dword [esp + 0x1c]
jb 0x4a54c0
mov ecx, esi
mov edx, esi
rol ecx, 0x10
xor edx, edi
sub edx, ecx
mov ecx, edx
xor eax, edx
rol ecx, 4
sub eax, ecx
pop ebp
mov ecx, eax
xor eax, esi
pop ebx
rol ecx, 0xe
pop edi
sub eax, ecx
pop esi
ret
pop edi
mov eax, esi
pop esi
ret

Function at 0x4a7220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.004a2e40
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x4a72d1
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.004a2e40
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x4a7282
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4abfe0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov eax, dword [0x613000]
push esi
mov esi, ecx
test eax, eax
jne 0x4ac01a
push eax
push eax
push 0x590270
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
je 0x4ac0af
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x613000], eax
test eax, eax
je 0x4ac0af
push 0x20
push esi
call eax
test al, al
je 0x4ac0af
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
ja 0x4ac042
jb 0x4ac037
cmp eax, 2
jae 0x4ac042
add eax, 2
mov dword [esi], eax
adc ecx, 0
mov dword [esi + 4], ecx
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
test ecx, ecx
ja 0x4ac05f
jb 0x4ac053
cmp eax, 0x40
jae 0x4ac05f
add eax, 0x40
mov dword [esi + 8], eax
adc ecx, 0
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
ja 0x4ac080
jb 0x4ac072
cmp eax, 0x200
jae 0x4ac080
add eax, 0x200
mov dword [esi + 0x10], eax
adc ecx, 0
mov dword [esi + 0x14], ecx
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
test ecx, ecx
ja 0x4ac0a1
jb 0x4ac093
cmp eax, 0x20000
jae 0x4ac0a1
add eax, 0x20000
mov dword [esi + 0x18], eax
adc ecx, 0
mov dword [esi + 0x1c], ecx
mov ecx, esi
call fcn.004ac0c0
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4af3a0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0xa
mov al, byte [esi]
test al, al
je 0x4af3e5
movsx ecx, al
inc esi
cmp ecx, 0x66
je 0x4af3cd
cmp ecx, 0x69
je 0x4af528
cmp ecx, 0x6c
jne 0x4af3df
mov eax, dword [ebx + 8]
push ebx
mov dword [eax + 0xb18], ecx
call fcn.004aab30
add esp, 4
mov al, byte [esi]
test al, al
jne 0x4af3b6
mov esi, dword [0x613008]
test esi, esi
je 0x4af475
cmp dword [ebx + 8], esi
jne 0x4af58b
push 0xffffffffffffffff
push dword [0x613054]
mov dword [0x613058], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x61303c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and byte [esi + 0x55], 0x7f
push esi
call fcn.004a9fe0
push ebx
mov dword [esi + 0xb18], 0
call fcn.004aab30
mov ecx, dword [0x61301c]
mov eax, dword [0x613018]
sub eax, ecx
sub dword [esi + 8], eax
push 0
push eax
mov eax, dword [esi]
push ecx
push dword [esi + 4]
call eax
add esp, 0x18
mov dword [0x613018], 0
mov dword [0x613014], 0
mov dword [0x613008], 0
cmp dword [0x613030], 0
mov eax, dword [ebx + 8]
mov dword [0x613008], eax
mov eax, dword [esp + 0x18]
mov dword [0x61300c], eax
mov eax, dword [esp + 0x1c]
mov dword [0x613024], edi
mov dword [0x613010], eax
mov dword [0x613028], 0
mov dword [0x613020], ebx
mov dword [0x61301c], 0
mov dword [0x613018], 0
mov dword [0x613014], 0
jne 0x4af559
push 0
push 0
push str.winmm.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [0x613030], eax
test eax, eax
je 0x4af559
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeBeginPeriod
push eax
call esi
push str.timeEndPeriod
push dword [0x613030]
mov dword [0x613034], eax
call esi
cmp dword [0x613034], 0
mov dword [0x613038], eax
je 0x4af51a
test eax, eax
jne 0x4af559
pop edi
pop esi
mov dword [0x613030], 0
pop ebx
ret
mov al, byte [esi]
xor edi, edi
cmp al, 0x30
jl 0x4af54f
cmp al, 0x39
ja 0x4af547
movzx eax, al
lea edi, [edi + edi*4]
inc esi
lea edi, [edi - 0x18]
lea edi, [eax + edi*2]
mov al, byte [esi]
cmp al, 0x30
jge 0x4af530
test edi, edi
jg 0x4af3df
mov edi, 1
jmp 0x4af3df
push 0x61303c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0x613008
push 0x4af620
push 0
push 0
mov dword [0x613058], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x613054], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4b0590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.004afa70
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x4b0647
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x4b0618.19
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x5920e0]
and cx, 7
cmp cx, 2
jne 0x4b05ff
cmp edi, ebx
jb 0x4b05c2
cmp edx, 0x2c
jne case.0x4b0618.19
shr eax, 0x10
cmp edi, eax
ja 0x4b05c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x4b05c2
cmp ebx, edi
jne 0x4b05c2
add edx, 0xffffffee
cmp edx, 0x27
ja case.0x4b0618.19
movzx ecx, byte [edx + 0x4b0724]
jmp dword [ecx*4 + 0x4b0710]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.004afa70
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4b05c2
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, str.local
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x14
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x14
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x12
jne 0x4b06c2
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x4b06c2
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x4b06c2
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x4b06ef
mov eax, dword [esp + 0x20]
mov edx, 0x5e3b9f
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x4b06ff
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4b06f3
sub eax, 1
jne 0x4b06f3
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret