joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c303
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 0xc]
mov edi, eax
imul edi, ebx
sub ebx, dword [ecx + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
add edi, dword [ecx + 0x14]
cmp dword [ecx + 8], 0xfe
mov dword [ebp - 4], edi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], eax
jge 0x48c41b
mov eax, dword [ecx + 4]
mov edx, dword [edi]
mov edi, 0xff00ff
mov esi, dword [eax + 0xc]
imul esi, ebx
add esi, dword [ecx + 0x18]
movzx ebx, byte [esi + 1]
or ebx, 0xff0000
imul ebx, dword [ecx + 8]
mov ecx, pe_nt_image_headers32
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub ecx, eax
mov eax, edx
shr eax, 8
and eax, edi
imul eax, ecx
shr eax, 8
and eax, edi
movzx edi, byte [esi + 2]
add ebx, eax
shl edi, 0x10
movzx eax, byte [esi]
mov esi, 0xff00ff
or edi, eax
and edx, esi
mov eax, dword [ebp - 8]
imul edx, ecx
imul edi, dword [eax + 8]
mov eax, ebx
shr eax, 8
shr edx, 8
and eax, esi
and edx, esi
shr edi, 8
and edi, esi
add edi, edx
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, edi
shr ecx, 8
mov eax, ebx
shl eax, 8
and ecx, esi
shl edx, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, pe_nt_image_headers32
or eax, edi
mov edi, dword [ebp - 4]
xor edx, eax
mov eax, ebx
shr eax, 8
and edx, esi
and eax, esi
shl ebx, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, ebx
mov ebx, dword [ebp + 8]
xor edx, ecx
mov ecx, dword [ebp - 8]
inc ebx
mov dword [edi], edx
add edi, dword [ebp - 0xc]
dec eax
mov dword [ebp + 8], ebx
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48c341
jmp 0x48c486
mov edx, dword [ecx + 4]
mov esi, dword [edx + 0xc]
mov edx, esi
imul edx, ebx
mov ebx, dword [ebp - 0xc]
add edx, dword [ecx + 0x18]
cmp ebx, esi
jne 0x48c452
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 1
jne 0x48c452
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 1
jne 0x48c452
imul esi, eax
push esi
push edx
push edi
call fcn.004db470
add esp, 0xc
jmp 0x48c486
mov ax, word [edx]
movzx ecx, byte [edx + 2]
add edx, esi
or ecx, 0xffffff00
mov word [ebp + 8], ax
movzx eax, byte [ebp + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 8]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi], ecx
add edi, ebx
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48c452
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48c48f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], ecx
mov eax, dword [edi]
mov esi, dword [edi + 8]
imul esi, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
imul ebx, eax
sub eax, dword [edi + 0xc]
sar esi, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 8], eax
add ebx, dword [edi + 0x14]
cmp esi, 0xfe
jge 0x48c5a6
mov ecx, dword [edi + 4]
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
add edx, dword [edi + 0x18]
movzx eax, byte [edx]
mov edx, eax
shl edx, 0x10
or edx, eax
imul edx, esi
mov esi, dword [ebx]
shr edx, 8
and edx, 0xff00ff
mov edi, edx
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, esi
shr eax, 8
and eax, 0xff00ff
imul eax, ecx
shr eax, 8
and eax, 0xff00ff
add edi, eax
mov eax, 0xff00ff
and esi, eax
imul esi, ecx
shr esi, 8
and esi, eax
mov eax, edi
shr eax, 8
add esi, edx
and eax, 0xff00ff
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, esi
shr ecx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
shl edx, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
mov esi, dword [ebp + 0x10]
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x48c4d4
jmp 0x48c657
mov ecx, dword [edi + 4]
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
add edx, dword [edi + 0x18]
mov edi, dword [ebx]
mov esi, edi
shr edi, 8
movzx eax, byte [edx]
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, 0xff00ff
and edi, eax
and esi, eax
imul edi, edx
imul esi, edx
mov edx, pe_nt_image_headers32
shr edi, 8
and edi, eax
shr esi, 8
add edi, ecx
and esi, eax
add esi, ecx
mov eax, edi
shr eax, 8
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x48c5a6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48c660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], esi
mov dword [ebp + 0xc], ecx
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
imul ebx, eax
sub eax, dword [esi + 0xc]
mov dword [ebp + 8], eax
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
jge 0x48c769
mov ecx, dword [esi + 4]
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
add edx, dword [esi + 0x18]
movzx eax, byte [edx]
mov edx, eax
shl edx, 0x10
or edx, eax
imul edx, dword [esi + 8]
mov esi, dword [ebx]
shr edx, 8
and edx, 0xff00ff
mov edi, edx
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, esi
shr eax, 8
and eax, 0xff00ff
imul eax, ecx
shr eax, 8
and eax, 0xff00ff
add edi, eax
mov eax, 0xff00ff
and esi, eax
imul esi, ecx
shr esi, 8
and esi, eax
mov eax, edi
shr eax, 8
add esi, edx
and eax, 0xff00ff
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, esi
shr ecx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
shl edx, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x48c699
jmp 0x48c81a
mov ecx, dword [esi + 4]
cdq
mov edi, dword [ebx]
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
add edx, dword [esi + 0x18]
mov esi, edi
shr edi, 8
movzx eax, byte [edx]
sub ecx, eax
mov edx, eax
shl edx, 0x10
or edx, eax
mov eax, 0xff00ff
and edi, eax
and esi, eax
imul edi, ecx
imul esi, ecx
shr edi, 8
and edi, eax
shr esi, 8
and esi, eax
add edi, edx
add esi, edx
mov eax, edi
shr eax, 8
mov edx, pe_nt_image_headers32
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
and ecx, 0xff00ff
mov eax, edi
shl eax, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x48c769
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48c823
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0xc]
mov ebx, esi
push edi
mov edi, dword [ecx + 8]
imul edi, dword [ebp + 0x10]
imul ebx, edx
sub edx, dword [ecx + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
sar edi, 8
add ebx, dword [ecx + 0x14]
mov dword [ebp - 4], esi
mov dword [ebp + 0x10], edi
mov dword [ebp + 8], edx
cmp edi, 0xfe
jge 0x48c93b
mov eax, dword [ebp + 0xc]
mov esi, 0xff00ff
mov dword [ebp + 0xc], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0xc]
imul eax, edx
add eax, dword [ecx + 0x18]
mov ecx, pe_nt_image_headers32
movzx eax, byte [eax]
mov edx, eax
shl edx, 0x10
or edx, eax
imul edx, edi
shr edx, 8
and edx, esi
mov esi, dword [ebx]
mov edi, edx
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, esi
shr eax, 8
and eax, 0xff00ff
imul eax, ecx
shr eax, 8
and eax, 0xff00ff
add edi, eax
mov eax, 0xff00ff
and esi, eax
imul esi, ecx
shr esi, 8
and esi, eax
mov eax, edi
add esi, edx
shr eax, 8
and eax, 0xff00ff
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, esi
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
shr ecx, 8
and ecx, 0xff00ff
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, pe_nt_image_headers32
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, edi
mov edi, dword [ebp + 0x10]
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
mov edx, dword [ebp + 8]
add ebx, dword [ebp - 4]
inc edx
dec eax
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48c86f
jmp 0x48ca21
mov eax, dword [ecx + 4]
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0xc], edi
mov edx, dword [eax + 0xc]
mov eax, edx
imul eax, dword [ebp + 8]
mov dword [ebp - 8], edx
add eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
cmp esi, edx
jne 0x48c97f
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 1
jne 0x48c97f
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 1
jne 0x48c97f
imul edx, edi
push edx
push eax
push ebx
call fcn.004db470
add esp, 0xc
jmp 0x48ca21
movzx eax, byte [eax]
mov edx, pe_nt_image_headers32
mov edi, dword [ebx]
sub edx, eax
mov ecx, eax
mov esi, edi
shl ecx, 0x10
or ecx, eax
shr edi, 8
mov eax, 0xff00ff
and edi, eax
and esi, eax
imul edi, edx
imul esi, edx
mov edx, pe_nt_image_headers32
shr edi, 8
and edi, eax
shr esi, 8
and esi, eax
add edi, ecx
add esi, ecx
mov eax, edi
shr eax, 8
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
shl ecx, 8
or ecx, edi
mov dword [ebp + 8], eax
xor edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x48c97f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48ca2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx]
push ebx
push esi
push edi
mov esi, dword [eax + 0xc]
mov ebx, esi
mov edi, dword [ebp + 8]
imul ebx, edi
sub edi, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
add ebx, dword [ecx + 0x14]
cmp dword [ecx + 8], 0xfe
mov dword [ebp - 4], esi
mov dword [ebp + 8], edi
jge 0x48cb34
mov esi, 0xff00ff
mov dword [ebp + 0xc], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0xc]
imul eax, edi
add eax, dword [ecx + 0x18]
movzx eax, byte [eax]
mov edx, eax
shl edx, 0x10
or edx, eax
imul edx, dword [ecx + 8]
mov ecx, pe_nt_image_headers32
shr edx, 8
and edx, esi
mov esi, dword [ebx]
mov edi, edx
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, esi
shr eax, 8
and eax, 0xff00ff
imul eax, ecx
shr eax, 8
and eax, 0xff00ff
add edi, eax
mov eax, 0xff00ff
and esi, eax
imul esi, ecx
shr esi, 8
and esi, eax
mov eax, edi
shr eax, 8
add esi, edx
and eax, 0xff00ff
mov edx, pe_nt_image_headers32
sub edx, eax
mov ecx, esi
shr ecx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
shl edx, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, pe_nt_image_headers32
or eax, esi
mov esi, 0xff00ff
xor edx, eax
mov eax, edi
shr eax, 8
and edx, esi
and eax, esi
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, edi
mov edi, dword [ebp + 8]
xor edx, ecx
mov ecx, dword [ebp - 8]
inc edi
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48ca6a
jmp 0x48cc17
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0xc]
mov eax, edx
imul eax, edi
mov dword [ebp - 0x14], edx
add eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
cmp esi, edx
jne 0x48cb75
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 1
jne 0x48cb75
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 1
jne 0x48cb75
imul edx, dword [ebp + 0xc]
push edx
push eax
push ebx
call fcn.004db470
add esp, 0xc
jmp 0x48cc17
movzx eax, byte [eax]
mov edx, pe_nt_image_headers32
mov edi, dword [ebx]
sub edx, eax
mov ecx, eax
mov esi, edi
shl ecx, 0x10
or ecx, eax
shr edi, 8
mov eax, 0xff00ff
and edi, eax
and esi, eax
imul edi, edx
imul esi, edx
mov edx, pe_nt_image_headers32
shr edi, 8
and edi, eax
shr esi, 8
and esi, eax
add edi, ecx
add esi, ecx
mov eax, edi
shr eax, 8
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
shl ecx, 8
or ecx, edi
mov dword [ebp + 8], eax
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec ecx
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x48cb75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48de7b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov esi, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 8]
imul eax, dword [ebp + 0x10]
imul esi, ebx
sub ebx, dword [edi + 0xc]
sar eax, 8
add esi, dword [edi + 0x14]
cmp eax, 0xfe
jge 0x48def6
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax + 3]
imul edx, dword [ebp + 8]
movzx eax, byte [esi]
shr edx, 8
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48deb5
jmp 0x48df34
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax + 3]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48defc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x48df3d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov esi, eax
imul esi, ebx
sub ebx, dword [edi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
add esi, dword [edi + 0x14]
cmp dword [edi + 8], 0xfe
jge 0x48dfaf
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax + 3]
mov eax, dword [edi + 8]
inc eax
imul edx, eax
movzx eax, byte [esi]
shr edx, 8
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48df6b
jmp 0x48dfe7
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax + 3]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48dfaf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48e30a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov esi, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 8]
imul eax, dword [ebp + 0x10]
imul esi, ebx
sub ebx, dword [edi + 0xc]
sar eax, 8
add esi, dword [edi + 0x14]
cmp eax, 0xfe
jge 0x48e384
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax]
imul edx, dword [ebp + 8]
movzx eax, byte [esi]
shr edx, 8
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48e344
jmp 0x48e3c1
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48e38a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x48e3ca
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov esi, eax
imul esi, ebx
sub ebx, dword [edi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
add esi, dword [edi + 0x14]
cmp dword [edi + 8], 0xfe
jge 0x48e43b
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax]
mov eax, dword [edi + 8]
inc eax
imul edx, eax
movzx eax, byte [esi]
shr edx, 8
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48e3f8
jmp 0x48e472
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, pe_nt_image_headers32
movzx edx, byte [edx + eax]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
mov eax, dword [ebp + 0xc]
sar ecx, 8
add cl, dl
inc ebx
mov byte [esi], cl
add esi, dword [ebp - 4]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x48e43b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48e47b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [eax + 0xc]
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebx]
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 0xf]
mov esi, edi
movzx eax, al
and esi, 0xff00ff
sub edx, eax
shr edi, 8
mov eax, dword [ebp + 0xc]
mov ecx, eax
imul esi, edx
and ecx, 0xff00ff
shr eax, 8
shr esi, 8
and esi, 0xff00ff
add esi, ecx
mov ecx, 0xff00ff
and edi, ecx
and eax, ecx
imul edi, edx
mov edx, pe_nt_image_headers32
shr edi, 8
and edi, ecx
add edi, eax
mov eax, edi
shr eax, 8
and eax, ecx
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
and ecx, 0xff00ff
mov eax, edi
shl eax, 8
or edx, eax
mov eax, pe_nt_image_headers32
sub eax, ecx
mov ecx, 0xff00ff
or eax, esi
xor edx, eax
mov eax, edi
and edx, ecx
shr eax, 8
and eax, ecx
shl edi, 8
mov ecx, pe_nt_image_headers32
sub ecx, eax
mov eax, dword [ebp + 0x10]
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
dec eax
mov dword [ebp + 0x10], eax
test eax, eax
jg 0x48e48d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49aa4a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503745
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [esp + 0xc], 0x54e828
cvtss2sd xmm0, xmm1
movsd qword [esp + 0x14], xmm0
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push 0
push eax
push ecx
mov ecx, esp
push 0x555b50
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
or dword [esp + 0x30], 0xffffffff
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 4
Function at 0x49bacb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503f35
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esp + 0x30]
call fcn.0043f03b
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], ebx
call fcn.00499459
push eax
lea ecx, [esi + 8]
call fcn.0042db8c
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
mov eax, dword [ebp + 0xc]
pop ecx
mov ecx, esi
push dword [eax + 0x24]
lea eax, [esp + 0x30]
push eax
call fcn.0049caf1
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call fcn.0049dc0a
push eax
mov ecx, esi
call fcn.0049ca62
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov word [esp + 0x28], 1
lea eax, [esp + 0x1c]
mov byte [esp + 0x48], 1
push eax
lea ecx, [esp + 0x30]
call fcn.0049b6db
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.0049b470
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], bl
call fcn.0041267d
lea ecx, [esp + 0x2c]
call fcn.0043fdb3
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x49c2d7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.004b8486
and dword [esp + 0x38], 0
lea ecx, [esp + 0x14]
push eax
call fcn.00427093
push 0
mov eax, ecx
mov byte [esp + 0x3c], 1
push eax
push ecx
mov ecx, esp
push 0x555a84
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
mov byte [esp + 0x38], 0
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8