joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1eb0
Capabilities:
Terminate process

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004a1ee0
push dword [esp + 0x10]
call fcn.004a0920
add esp, 0x10
test al, al
jne fcn.004ff670
ret

Function at 0x4a35f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd75d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x72cec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0x72ed50
mov ecx, 1
mov esi, 0x72ed50
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x4a363a
mov ecx, esi
call fcn.004f8c80
mov byte [ebp - 0x14], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ecx + 8], 0x7ffe
jg 0x4a3662
call fcn.00498670
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4a3729
push 0xfffe
call fcn.00596a3c
mov edx, dword [ebp + 8]
add esp, 4
xor edi, edi
mov ebx, eax
mov ecx, dword [edx + 8]
test ecx, ecx
jle 0x4a3720
mov edx, dword [edx + 4]
mov eax, ecx
sub eax, edi
mov dword [ebp - 0x14], edx
mov esi, 0x7ffe
mov edx, edi
cmp eax, esi
mov dword [ebp - 0x10], edx
cmovl esi, eax
cmp edi, ecx
jg 0x4a36e4
test edi, edi
jns 0x4a36c6
test esi, esi
js 0x4a36ba
add esi, edi
cmp esi, ecx
jge 0x4a36ba
test esi, esi
jle 0x4a36e4
mov eax, dword [ebp - 0x14]
xor edx, edx
lea ecx, [eax + edx*2]
jmp 0x4a36e8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov esi, ecx
lea ecx, [eax + edx*2]
jmp 0x4a36e8
mov eax, ecx
sub eax, edi
cmp esi, eax
cmova esi, eax
mov eax, esi
test edi, edi
jne 0x4a36dc
mov edx, dword [ebp - 0x10]
cmp eax, ecx
jne 0x4a36dc
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx*2]
jmp 0x4a36e8
xor esi, esi
xor ecx, ecx
test ecx, ecx
je 0x4a36fa
lea eax, [esi + esi]
push eax
push ecx
push ebx
call fcn.00599570
add esp, 0xc
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp + 8]
add edi, 0x7ffe
mov ecx, dword [edx + 8]
cmp edi, ecx
jl 0x4a3681
mov esi, 0x72ed50
push ebx
call fcn.005971d5
add esp, 4
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x4a3740
mov ecx, esi
call fcn.004f8e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b31e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4b3230
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4b31f2
mov eax, dword [edi]
jmp 0x4b3317
cmp eax, 0x4e0
jb 0x4b3317
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x4b3250
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x4b32a0
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x4b3410
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0730
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x72cec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movq xmm0, qword [0x7304a0]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub edi, edx
movq qword [ebp - 0x14], xmm0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
and ecx, 0x800
sar edi, 2
or ecx, ebx
mov dword [ebp - 0x10], eax
je 0x4b3474
push edi
push edx
call fcn.00516c20
mov edx, dword [ebp + 8]
add esp, 8
mov ebx, eax
cmp ebx, edi
je 0x4b34d8
mov esi, edi
sub esi, ebx
shl esi, 2
push esi
lea eax, [edx + ebx*4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
xor ecx, ecx
test al, al
cmovne ecx, esi
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add ebx, eax
cmp ebx, edi
je 0x4b34d8
mov eax, dword [ebp + 8]
sub edi, ebx
lea esi, [eax + ebx*4]
lea edi, [esi + edi*4]
cmp esi, edi
je 0x4b34d8
nop dword [eax + eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0059fb0f
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], eax
add esi, 4
cmp esi, edi
jne 0x4b34c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b3560
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0750
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x72cec4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0x10
nop
push 0x10
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov dword [ebp - 4], 0xffffffff
test al, al
jne 0x4b35d7
sub esi, 1
jne 0x4b3590
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x34]
push eax
call fcn.0059fb0f
mov eax, dword [ebp - 0x34]
add esp, 4
mov dword [esi], eax
add esi, 4
lea eax, [ebp - 0x10]
cmp esi, eax
jne 0x4b35b6
movups xmm0, xmmword [ebp - 0x20]
jmp 0x4b35db
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [ebp + 8]
movups xmmword [eax], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596709
mov esp, ebp
pop ebp
ret
Function at 0x4b3600
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x72cec4]
xor eax, esp
mov dword [esp + 0x9c0], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x9d4]
mov edx, 0x1571
mov ecx, 1
mov dword [edi], 1
lea esi, [edi + 0xc]
mov dword [edi + 0x1388], 0xffffffff
mov dword [edi + 8], 0x1571
mov eax, edx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [esi - 4], edx
cmp ecx, 0x270
jb 0x4b3642
push ebx
lea eax, [esp + 0x9d0]
mov dword [edi + 4], 0x270
push eax
lea eax, [esp + 0x14]
mov ecx, 0x72edc8
push eax
call fcn.004b3410
xor edx, edx
lea ebx, [edi + 8]
xor esi, esi
mov eax, dword [esp + esi*4 + 0x10]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebx - 4], eax
or ecx, edx
mov edx, eax
shr edx, 0x1f
test esi, esi
cmovne edx, ecx
inc esi
cmp esi, 0x270
jb 0x4b3686
pop ebx
test edx, edx
jne 0x4b36b3
mov dword [edi + 8], 0xffffffff
mov ecx, dword [esp + 0x9cc]
mov dword [edi + 4], 0x270
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00596709
add esp, 0x9c4
ret
Function at 0x4b9b00
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 0xc]
movd xmm0, dword [esp + 0x10]
mov ecx, dword [esp + 4]
pshufd xmm4, xmm0, 0
movd xmm0, eax
cwde
push esi
mov esi, dword [esp + 0xc]
pinsrw xmm0, eax, 4
pshufhw xmm1, xmm0, 0
lea edx, [ecx + esi]
pxor xmm1, xmm4
aesenc xmm1, xmm1
cmp esi, 0x10
jae 0x4b9b87
test esi, esi
je 0x4b9c70
test ecx, 0x800
jne 0x4b9b5b
movups xmm0, xmmword [ecx]
mov eax, 0x62e41f
sub eax, esi
movups xmm2, xmmword [eax]
pand xmm2, xmm0
jmp 0x4b9b6e
movups xmm2, xmmword [edx - 0x10]
mov eax, 0x62e43f
sub eax, esi
movups xmm0, xmmword [eax]
pshufb xmm2, xmm0
pxor xmm1, xmm2
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd eax, xmm1
pop esi
ret
cmp esi, 0x20
ja 0x4b9bde
lea eax, [ecx + 0x10]
movaps xmm3, xmm1
aesenc xmm3, xmm4
cmp eax, edx
jae 0x4b9bb6
movups xmm0, xmmword [edx - 0x10]
movups xmm2, xmmword [ecx]
pxor xmm3, xmm0
aesenc xmm3, xmm3
pxor xmm2, xmm1
aesenc xmm3, xmm3
jmp 0x4b9bca
movaps xmm2, xmm1
cmp ecx, edx
je 0x4b9bd4
movups xmm2, xmmword [edx - 0x10]
pxor xmm2, xmm1
aesenc xmm2, xmm2
aesenc xmm2, xmm2
aesenc xmm2, xmm2
pxor xmm2, xmm3
movd eax, xmm2
pop esi
ret
lea eax, [ecx + 0x20]
movaps xmm2, xmm1
aesenc xmm2, xmm4
cmp eax, edx
jae 0x4b9c1d
nop dword [eax]
movups xmm0, xmmword [ecx]
add ecx, 0x20
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
add eax, 0x20
aesenc xmm1, xmm1
pxor xmm2, xmm0
aesenc xmm2, xmm2
aesenc xmm1, xmm1
aesenc xmm2, xmm2
cmp eax, edx
jb 0x4b9bf0
lea eax, [ecx + 0x10]
cmp eax, edx
jae 0x4b9c51
movups xmm0, xmmword [ecx]
pop esi
pxor xmm1, xmm0
movups xmm0, xmmword [edx - 0x10]
aesenc xmm1, xmm1
aesenc xmm1, xmm1
pxor xmm2, xmm0
aesenc xmm2, xmm2
aesenc xmm2, xmm2
pxor xmm1, xmm2
movd eax, xmm1
ret
cmp ecx, edx
je 0x4b9c6c
movups xmm0, xmmword [edx - 0x10]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
pxor xmm1, xmm2
movd eax, xmm1
pop esi
ret
Function at 0x4b9c80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 0xc]
movd xmm0, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
pshufd xmm4, xmm0, 0
movd xmm0, eax
cwde
push esi
lea esi, [ecx + edx]
pinsrw xmm0, eax, 4
pshufhw xmm2, xmm0, 0
pxor xmm2, xmm4
aesenc xmm2, xmm2
cmp edx, 0x10
jae 0x4b9d03
test edx, edx
je 0x4b9cfd
test ecx, 0x800
jne 0x4b9cd7
movups xmm0, xmmword [ecx]
mov eax, 0x62e41f
sub eax, edx
movups xmm1, xmmword [eax]
pand xmm1, xmm0
jmp 0x4b9cea
movups xmm1, xmmword [esi - 0x10]
mov eax, 0x62e43f
sub eax, edx
movups xmm0, xmmword [eax]
pshufb xmm1, xmm0
pxor xmm2, xmm1
aesenc xmm2, xmm2
aesenc xmm2, xmm2
aesenc xmm2, xmm2
movd eax, xmm2
pop esi
ret
cmp edx, 0x20
ja 0x4b9d5a
lea eax, [ecx + 0x10]
movaps xmm3, xmm2
aesenc xmm3, xmm4
cmp eax, esi
jae 0x4b9d32
movups xmm0, xmmword [esi - 0x10]
movups xmm1, xmmword [ecx]
pxor xmm3, xmm0
aesenc xmm3, xmm3
pxor xmm1, xmm2
aesenc xmm3, xmm3
jmp 0x4b9d46
movaps xmm1, xmm2
cmp ecx, esi
je 0x4b9d50
movups xmm1, xmmword [esi - 0x10]
pxor xmm1, xmm2
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
pxor xmm1, xmm3
movd eax, xmm1
pop esi
ret
movaps xmm1, xmm2
aesenc xmm1, xmm4
vmovdqu xmm0, xmm2
vinsertf128 ymm0, ymm0, xmm1, 1
pop esi
jmp fcn.004b9d80

Function at 0x4b9e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffe0
sub esp, 0x40
movq xmm0, qword [0x7304a0]
movq qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x18]
and ecx, 0x8000000
or ecx, 0
je 0x4b9f3b
movq xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x18]
and ecx, 0x400000
or ecx, 0
je 0x4b9f23
mov eax, dword [ebp + 0x10]
movd xmm0, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
pshufd xmm2, xmm0, 0
movd xmm0, eax
cwde
pinsrw xmm0, eax, 4
pshufhw xmm0, xmm0, 0
pxor xmm0, xmm2
aesenc xmm0, xmm0
movaps xmm1, xmm0
aesenc xmm1, xmm2
cmp edx, 0x20
ja 0x4b9f11
vinsertf128 ymm1, ymm0, xmm1, 1
test edx, edx
je 0x4b9f06
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
bzhi eax, eax, edx
kmovd k1, eax
vmovdqu8 ymm0 {k1} {z}, ymmword [ecx]
vmovdqu ymmword [esp + 0x20], ymm0
cmp edx, 0x10
jb 0x4b9ee9
vpxor ymm0, ymm0, ymm1
vaesenc ymm0, ymm0, ymm0
vaesenc ymm1, ymm0, ymm0
vextracti128 xmm0, ymm1, 1
vpxor xmm1, xmm1, xmm0
vmovd eax, xmm1
vzeroupper
mov esp, ebp
pop ebp
ret
vmovaps xmm0, xmmword [esp + 0x20]
vpxor xmm0, xmm0, xmm1
vaesenc xmm0, xmm0, xmm0
vaesenc xmm0, xmm0, xmm0
vaesenc xmm0, xmm0, xmm0
vmovaps xmm1, xmm0
vmovd eax, xmm1
vzeroupper
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
vinsertf128 ymm0, ymm0, xmm1, 1
call fcn.004b9d80
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b9c80
add esp, 0x10
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b9b00
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4ba090
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ebx
push edi
and esi, 0xfffffffc
mov edi, ebx
xor edi, dword [esp + 0x18]
add esi, eax
cmp eax, esi
je 0x4ba0d2
nop dword [eax]
imul edx, dword [eax], 0x5bd1e995
add eax, 4
imul edi, edi, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, ecx, 0x5bd1e995
xor edi, edx
cmp eax, esi
jne 0x4ba0b0
and ebx, 3
je 0x4ba0f5
add esi, ebx
xor edx, edx
cmp eax, esi
je 0x4ba0ed
nop
movzx ecx, byte [eax]
inc eax
shl edx, 8
or edx, ecx
cmp eax, esi
jne 0x4ba0e0
xor edx, edi
imul edi, edx, 0x5bd1e995
mov eax, edi
shr eax, 0xd
xor eax, edi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x4ba1e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test edx, edx
je 0x4ba212
movzx ecx, word [esi]
lea esi, [esi + 2]
shl eax, 4
add ecx, eax
mov eax, ecx
shr eax, 0x17
and eax, 0x1e0
xor eax, ecx
and eax, 0xfffffff
sub edx, 1
jne 0x4ba1f1
pop esi
ret

Function at 0x4ba220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
and eax, 0xfffffffc
mov ecx, ebp
add eax, ebx
shl ebp, 0x18
push esi
mov esi, dword [esp + 0x20]
and ecx, 3
mov dword [esp + 0xc], eax
mov eax, edx
push edi
mov edi, esi
mov dword [esp + 0x20], ebp
xor eax, 0x74656462
xor edi, 0x6c796765
xor edx, 0x646f7261
xor esi, 0x736f6d65
cmp ebx, dword [esp + 0x10]
je 0x4ba2a4
mov ebp, dword [esp + 0x10]
xor eax, dword [ebx]
add esi, edx
add edi, eax
rol edx, 7
xor edx, esi
rol eax, 8
xor eax, edi
rol esi, 0x10
add esi, eax
add edi, edx
rol eax, 0xb
xor eax, esi
rol edx, 9
xor esi, dword [ebx]
xor edx, edi
add ebx, 4
rol edi, 0x10
cmp ebx, ebp
jne 0x4ba273
mov ebp, dword [esp + 0x20]
sub ecx, 1
je 0x4ba2c5
sub ecx, 1
je 0x4ba2bc
sub ecx, 1
jne 0x4ba2ca
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
or ebp, ecx
movzx ecx, byte [ebx + 1]
shl ecx, 8
or ebp, ecx
movzx ecx, byte [ebx]
or ebp, ecx
add esi, edx
xor eax, ebp
add edi, eax
rol edx, 7
xor edx, esi
rol eax, 8
xor eax, edi
rol esi, 0x10
add edi, edx
add esi, eax
rol eax, 0xb
xor eax, esi
rol edx, 9
xor edx, edi
xor esi, ebp
add esi, edx
rol edi, 0x10
xor edi, 0xff
rol edx, 7
add edi, eax
xor edx, esi
rol eax, 8
xor eax, edi
rol esi, 0x10
add edi, edx
add esi, eax
rol eax, 0xb
xor eax, esi
rol edx, 9
xor edx, edi
rol edi, 0x10
add edi, eax
add esi, edx
rol eax, 8
rol edx, 7
xor eax, edi
xor edx, esi
rol eax, 0xb
add edi, edx
rol edx, 9
mov ecx, edi
rol ecx, 0x10
xor eax, ecx
xor eax, edx
xor eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4ba350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0f3c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x72cec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0
push 8
mov dword [ebp - 4], 0
call fcn.00596a0c
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004fc280
mov edi, eax
mov byte [ebp - 4], 0
push 1
mov ecx, edi
call fcn.00487140
mov ecx, dword [edi]
push dword [ebp + 0xc]
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x5cd3f0]
mov ecx, edi
call esi
mov dword [ebx + 4], edi
mov eax, ebx
mov word [ebx + 8], 1
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0x14
mov dword [ebx + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c7880
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
add ecx, 4
push edi
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ecx]
mov dword [esi + 4], eax
mov eax, dword fs:[0x2c]
mov dword [ecx], esi
mov ecx, dword [0x730f2c]
mov edi, dword [eax + ecx*4]
cmp byte [edi + 0x30], 0
jne 0x4c78cd
call fcn.00597754
lea ecx, [edi + 0x18]
mov dword [esi + 0xc], ecx
mov eax, dword [ecx]
mov dword [esi + 0x10], eax
mov eax, esi
pop edi
mov dword [ecx], 0
pop esi
ret 8
Function at 0x4cfc90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2414
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x72cec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
test eax, eax
jne 0x4cfd8e
push 0x64
call fcn.00596a0c
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov word [eax + 0x60], 0
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
cmp eax, 1
je 0x4cfdd8
mov esi, dword [edi]
push 0x64
call fcn.00596a0c
add esp, 4
mov dword [ebp - 0x10], eax
push dword [edi]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004ceca0
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi], eax
cmp eax, 1
jne 0x4cfdd8
test esi, esi
je 0x4cfdd8
mov ecx, esi
call fcn.004cee10
push 0x64
push esi
call fcn.005966fb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e32c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c39ce
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x72cec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4000
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x4e3391
push 0xffffffffffffffff
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.004b6680
mov ecx, dword [edi]
mov edx, eax
add esp, 0xc
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edi + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4e3388
or eax, 0xffffffff
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x4e3388
push 4
push 2
push dword [ebp - 0x20]
call fcn.00461780
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [edi + 8], 0
jne 0x4e33e6
mov ecx, esi
mov edx, 0x69bee0
mov ebx, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4e33bd
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x4e33a3
push str.C:_tempqt_common
push 0x11
jmp 0x4e33df
mov ecx, 0x69bf00
mov edx, 0xc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x4e33e6
add esi, 4
add ecx, 4
sub edx, 4
jae 0x4e33c7
push str.C:_tempqt_user
push 0xf
mov ecx, edi
call fcn.0048f5f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x18], 0
push esi
mov esi, ecx
mov dword [esp + 4], esi
jbe 0x4f8216
push ebx
push ebp
push edi
xor edi, edi
mov dword [esp + 0x14], edi
nop
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x10]
add edx, edi
xor ebp, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebp
mov al, byte [edx + ebp]
cmp al, 0xff
je 0x4f81ed
cmp byte [esp + 0x2c], 0
movzx eax, al
lea ecx, [eax + eax*4]
mov eax, dword [edx + 0x80]
lea ebx, [eax + ecx*4]
je 0x4f8163
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edi, dword [esi + 8]
mov edx, dword [ebx + 8]
dec edi
shl eax, 4
add eax, ecx
add eax, edx
xor eax, dword [esi + 0xc]
and edi, eax
mov eax, edi
and edi, 0x7f
shr eax, 7
imul esi, eax, 0x88
mov eax, dword [esp + 0x10]
add esi, dword [eax + 0x10]
movzx eax, byte [edi + esi]
cmp eax, 0xff
je 0x4f816a
mov ebp, ecx
nop word [eax + eax]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x80]
lea ecx, [eax + ecx*4]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x4f8114
cmp edx, dword [ecx + 8]
jne 0x4f8114
cmp ebp, dword [ecx + 4]
jne 0x4f8114
mov eax, dword [ebx + 0xc]
cmp eax, dword [ecx + 0xc]
je 0x4f815d
inc edi
cmp edi, 0x80
jne 0x4f8152
mov eax, dword [esp + 0x10]
add esi, 0x88
mov ecx, esi
xor edi, edi
sub ecx, dword [eax + 0x10]
mov eax, 0x78787879
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 8]
shr eax, 7
cmp ecx, eax
cmove esi, dword [edx + 0x10]
mov edx, dword [ebx + 8]
movzx eax, byte [edi + esi]
cmp eax, 0xff
jne 0x4f80f0
mov ebp, dword [esp + 0x1c]
jmp 0x4f816a
mov esi, dword [esi + 0x10]
add esi, edi
mov edi, ebp
mov dl, byte [esi + 0x85]
cmp dl, byte [esi + 0x84]
jne 0x4f8185
mov ecx, esi
call fcn.004f7580
mov dl, byte [esi + 0x85]
movzx eax, dl
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x80]
mov al, byte [eax + ecx*4]
mov byte [esi + 0x85], al
mov byte [edi + esi], dl
lea edi, [ecx*4 + 0x10]
mov eax, dword [esi + 0x80]
add edi, eax
movups xmm0, xmmword [ebx]
movups xmmword [eax + ecx*4], xmm0
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x4f81e1
nop word [eax + eax]
push 8
call fcn.00596a0c
mov ecx, dword [esi]
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [edi], eax
lea edi, [eax + 4]
mov esi, dword [esi + 4]
test esi, esi
jne 0x4f81c0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
inc ebp
mov dword [esp + 0x1c], ebp
cmp ebp, 0x80
jb 0x4f8083
add edi, 0x88
sub dword [esp + 0x28], 1
mov dword [esp + 0x14], edi
jne 0x4f8070
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4fb190
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret