joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ec30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8a68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4ba520]
push 0
lea ecx, [esp + 0x20]
call fcn.004b0e54
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0045e590
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004b0d82
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004ad643
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004ad643
push 1
push 0
push 0
mov ecx, esi
call fcn.004ad5eb
push 1
push 0
push 1
mov ecx, esi
call fcn.004ad5eb
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004b0ec6
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x45edb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004b0e54
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0045e590
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004b0d82
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4ba520]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x45ee74
cmp dword [esp + 0x40], 1
jne 0x45ee72
cmp ecx, eax
jge 0x45ee74
mov eax, ecx
cmp eax, 0xc8
jge 0x45ee80
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0045ec30
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4ba518]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004b0ec6
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x45f670
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8b33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004aba64
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4ba054]
push eax
mov ecx, edi
call fcn.004b10fc
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004b265b
test eax, eax
je 0x45f78c
mov ecx, dword [esp + 0x3c]
call fcn.004b1129
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4ba540]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45f750
push edi
mov ecx, esi
call fcn.004ae78e
mov ecx, esi
call fcn.0045f930
cmp dword [esp + 0x38], 1
jne 0x45f785
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ae8c9
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x461970
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4619a3
push esi
call fcn.0046fd20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46199c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x461a29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x461a12
mov eax, dword [esi + 8]
test eax, eax
je 0x4619c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x461a0e
cmp eax, 2
je 0x461a12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4619ba
cmp eax, 3
je 0x4619ed
cmp eax, 1
jne 0x4619ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4619ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4619ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00461a50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x461a38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00461a50
add esp, 4
pop esi
ret
Function at 0x484ae0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x53d664]
xor edx, edx
cmp eax, edx
jne 0x484b06
xor eax, eax
mov byte [eax + 0x53d564], al
inc eax
cmp eax, 0x100
jl 0x484aee
mov dword [0x53d664], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x53d564
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x484b97
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x484b6a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x484b38
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x484c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x484c63
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x484c4a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48b620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b93ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0048bf40
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4f350c
call fcn.004aa1cc
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x48b6b3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004aa1cc
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x48b6ac
push 0
mov ecx, eax
call fcn.00482720
mov dword [esi + 0xc], eax
jmp 0x48b6b5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x48b6b5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x55bbf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x55bd52
cmp edi, esi
je 0x55bd52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x55bd42
add edi, 4
jmp 0x55bca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x55bcb8
mov dword [ebp - 4], 2
jmp 0x55bcd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x55bccf
mov dword [ebp - 4], 1
jmp 0x55bcd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x55bd52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x55bd10
mov byte [ecx + 2], 0x3d
jmp 0x55bd1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x55bd2c
mov byte [ecx], 0x3d
jmp 0x55bd32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x55bca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf74e51
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
jmp 0x10207d5
mov ebx, dword [esi - 8]
btc di, ax
mov edi, dword [esi - 4]
add edi, dword [ebp + 0x10]
cmovne ax, ax
jmp 0x10b10bb
jne 0x10c4088
mov dword [esp + 0x18], edx
jmp 0x1065628
call fcn.0056ea80
add esp, 0xc
movzx eax, di
lea eax, [esp + 0x18]
cmp ebx, dword [esp + 0x14]
jmp 0xf95ec1
call fcn.0106bf42
test al, al
jmp 0x5657f9
push edx
movzx edx, bx
movzx dx, ch
jmp 0x10810dd
mov dword [esp + 0x10], 0
cmc
cmp dx, word [edi + 6]
jmp 0x1077881
je 0x10cbddf
mov eax, dword [edi + 0xa4]
test edx, eax
stc
test eax, eax
jmp 0xfc4e3e
call fcn.00f8d425
test eax, eax
jmp 0xf95a8e
push ebp
mov ebp, esp
shr al, 0x50
bt cx, 0xf6
and esp, 0xfffffff8
xor ax, 0x4512
sub esp, 0x114
movzx cx, dh
lahf
push ebx
mov al, 0xbe
push esi
mov esi, dword [ebp + 0xc]
movzx ecx, bx
push edi
lahf
xchg di, di
mov edi, dword [ebp + 8]
movzx ecx, bp
cmovp ecx, ebp
lea eax, [esp + 0x28]
mov cl, 0x77
push eax
setge al
mov eax, esi
movzx ecx, si
setnp cl
mov ecx, edi
jmp 0xf3ceb3
mov dword [esp + 0x20], eax
jmp 0x59d04f
jne 0x1010c0c
mov ebx, dword [ebp + 0x10]
cwd
mov edx, dword [esp + 0x7c]
push ebx
jmp 0x10165db
jb 0xf95ed5
lea eax, [esp + 0x14]
mov ecx, 0x65bf59c2
movzx edx, bx
cwd
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 8]
jmp 0x55b957
je 0x10cbddf
test byte [edi + 0x16], 1
jmp 0xfdf001
jne 0x10cbddf
xor ecx, ecx
clc
mov dword [esp + 0x14], ecx
test eax, eax
je 0x10cbddf
lea esp, [esp]
mov dword [esp + 0x24], ebx
jmp 0xf8df26
inc eax
cmp di, bx
lea esi, [esi + 0x28]
cmp cl, 0xdc
stc
mov dword [esp + 0x10], eax
cmp cx, 0x7381
test bl, bl
cmp eax, edx
jb 0x56274c
mov ebx, dword [ebp + 0x10]
mov di, bx
mov edi, ecx
mov edx, ebx
stc
clc
sub edx, dword [edi + 0x34]
jmp 0x567c30
push ebx
jmp 0x1052455
push eax
jmp 0x10b59e3
push 0
push ecx
jmp 0xf1f2c9
push 0
push edi
jmp 0xfe1403
je 0x10cbde4
cmp dword [edi + 0xa0], 0
jmp 0xf2f1f5
jae 0xfe6419
add esi, 0x10
jmp 0x56274c
call fcn.0106bf42
test al, al
je 0x5657ff
mov ecx, dword [esp + 0x1c]
xchg edx, eax
lahf
mov eax, ebp
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
jmp 0xfe63f3
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
jmp 0x107d4a5
mov eax, dword [esi]
jmp 0xff5e30
push eax
push edi
bswap ax
mov eax, esi
jmp 0xf0d4c2
mov edi, dword [ebx + 0x3c]
cmp sp, 0x7b5b
shld si, bp, 0x8a
movzx ecx, word [edi + ebx + 0x14]
add edi, ebx
bswap esi
xor edx, edx
btr esi, 7
sar si, 0x16
lea esi, [ecx + edi + 0x18]
test esi, eax
mov dword [esp + 0x1c], edi
clc
mov dword [esp + 0x20], esi
jmp 0xf224a8
Function at 0xf8d425
Capabilities:
Parse pe header

Disassembly:
pop edi
cwde
jmp 0x100e429
pop esi
mov esp, ebp
pop ebp
ret 4
ret 4
je 0x56070d
mov ecx, 0x5a4d
test edi, 0x1b784f40
jmp 0xfbf0f6
call fcn.0106bf42
test al, al
jmp 0xf35ca6
pop edi
cmovno si, cx
jmp 0x58f703
je 0x56070d
cmp dword [ebp - 0x13c], 0x4550
jmp 0xffcfc2
jne 0xfd72d7
mov ax, word [ebp - 0x138]
add cx, dx
bsf ecx, ecx
mov ecx, 0x14c
cmp ax, cx
je 0xf76dc6
mov edx, 0x14d
cmp esi, edi
cmp ax, dx
je 0xf76dc6
mov ecx, 0x14e
stc
cmp ax, cx
jmp 0xf76dc0
push edx
setg dl
cdq
jmp 0xf96641
jne 0xfd72d7
mov edi, dword [ebp + 8]
mov ecx, 0x6dd916b2
mov ecx, 0x3e
lea esi, [ebp - 0x13c]
jmp 0xfd72d0
cmp word [ebp - 0x124], ax
jmp 0xf4c232
push ebp
add ebp, esi
mov ebp, esp
stc
or edx, esp
sub esp, 0x13c
setg dl
cmova edx, ecx
push esi
bswap dx
push edi
bswap dx
mov esi, eax
lea eax, [ebp - 0x44]
xchg edi, edx
push eax
mov edi, 0x727540b5
movzx edi, sp
push 0
jmp 0x1029322
push edx
cmovns dx, bp
push eax
push edi
movzx edx, dx
mov edx, 0xf8
cbw
nop
mov eax, esi
jmp 0xf1fe38
cmp word [ebp - 0x44], cx
jmp 0xfc85e1
jne 0x56070d
mov eax, dword [ebp - 8]
jmp 0x10b6bc0
rep movsd dword es:[edi], dword [esi]
test sp, 0x6b32
xor eax, eax
jmp 0xf23cb9
jne 0x56070d
test dword [ebp - 0x126], 0x2000
je 0x56070d
mov eax, 0x10b
jmp 0xf89613
mov eax, 0xc000007b
movsx esi, ax
cmovg esi, edi
bswap si
pop esi
mov esp, ebp
movzx ebp, bx
pop ebp
jmp 0xee9974
mov edi, ecx
movzx dx, bl
mov al, dl
push 0
setno ah
push edi
mov edx, 0x40
movsx eax, si
not ah
movzx eax, bx
mov eax, esi
call fcn.0106bf42
test al, al
jmp 0xf027dd
test eax, eax
jmp 0x10cf9a3
je 0x56070d
lea edx, [ebp - 0x13c]
jmp 0xf65d9f
Function at 0x4d226a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004d241a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4d2368
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4d230b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4d234e
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4d2322
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4d233d
test al, 0x40
je 0x4d2334
mov ecx, dword [edi + 0x20]
jmp 0x4d233b
test al, 0x80
je 0x4d234e
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4d234e
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4d22da
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4f3270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x495fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.004ee170
test eax, eax
jne 0x4f32dc
push ebp
push 0x599f84
mov ecx, edi
call fcn.004f24f0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.004edba0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.004db440
push ebx
mov dword [esp + 0x4c], ebp
call fcn.004ee320
add esp, 4
test eax, eax
je 0x4f337f
add esi, 0x18
push esi
call fcn.004dbe70
add esi, eax
push esi
call fcn.004dbe70
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x4f3682
jmp dword [ecx*4 + 0x427ac0]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.004f2630
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.004dbe70
add esi, eax
push esi
call fcn.004dbe70
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x4f33d0
mov ecx, dword [esi + 0x1c]
push ecx
call dword [fcn.0049a45c]
test eax, eax
je 0x4f33d0
mov eax, 1
jmp 0x4f33d2
xor eax, eax
cmp ebx, 8
jge 0x4f3637
cmp ebx, 7
ja 0x4f3682
jmp dword [ebx*4 + 0x427ad0]
test eax, eax
jne 0x4f364a
mov ecx, dword [esp + 0x10]
push eax
push 0x599f70
call fcn.004f24f0
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.004f3b90
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x583e58
call fcn.004db640
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x4fc2c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5b63d0]
xor edx, edx
cmp eax, edx
jne 0x4fc2e6
xor eax, eax
mov byte [eax + 0x5b62d0], al
inc eax
cmp eax, 0x100
jl 0x4fc2ce
mov dword [0x5b63d0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5b62d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4fc377
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4fc34a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4fc318
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4fc380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4fc3d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4fc3ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret