joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bccc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0
push 0x5c9dfc
call fcn.00432860
mov byte [esp + 0x20], 1
lea ecx, [edi + 4]
push 0x5c9dfc
call fcn.00432860
mov byte [esp + 0x20], 2
lea ebp, [edi + 8]
push 0x5c9dfc
mov ecx, ebp
call fcn.00432860
mov byte [esp + 0x20], 3
sub esp, 8
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042edc0
mov byte [esp + 0x28], 4
mov byte [esp + 0x28], 3
call fcn.00451aa0
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov esi, eax
call fcn.0042edc0
mov byte [esp + 0x28], 5
mov byte [esp + 0x28], 3
call fcn.00451b10
add esp, 8
mov ebx, eax
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
call fcn.0040a1e0
mov byte [esp + 0x20], 6
push eax
mov ecx, ebp
call fcn.00403760
mov byte [esp + 0x20], 3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4560d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esi, ebx
dec esi
push esi
push ebx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
call fcn.00408cd0
mov byte [esp + 0x20], 8
push eax
lea ecx, [edi + 4]
call fcn.00403760
mov byte [esp + 0x20], 3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45611e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
call fcn.00408cd0
mov byte [esp + 0x20], 0xa
push eax
mov ecx, edi
call fcn.00403760
mov byte [esp + 0x20], 3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x456161
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.0042ee10
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 8
Function at 0x469560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5be6a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x78], 0
push 0x5c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0050eca0
mov ecx, dword [0x658580]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
mov ebx, dword [0x5c99bc]
add esp, 0xc
cmp dword [esi + 8], 0
je 0x4695bc
mov edi, dword [esi + 0x20]
jmp 0x4695c7
call ebx
push eax
call dword [0x5c99c0]
mov edi, eax
push 0x5a
push edi
call dword [0x5c91c4]
cmp dword [esi + 8], 0
mov ebp, eax
jne 0x4695e5
push edi
call ebx
push eax
call dword [0x5c99c4]
mov edi, dword [esp + 0x84]
push 0x48
test edi, edi
jge 0x4695ff
mov ebp, dword [0x5c9528]
push 0x60
push edi
call ebp
jmp 0x46960b
push ebp
mov ebp, dword [0x5c9528]
push edi
call ebp
neg eax
mov ecx, dword [esp + 0x88]
xor ebx, ebx
cmp dword [esp + 0x8c], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xa0]
setne dl
cmp dword [esp + 0x90], ebx
mov dword [esp + 0x18], eax
setne al
cmp dword [esp + 0x9c], ebx
mov dword [esp + 0x24], ecx
setne cl
cmp dword [esp + 0xa4], ebx
mov byte [esp + 0x2a], cl
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x2d], al
push str.segoue
setne al
mov byte [esp + 0x30], dl
mov dl, byte [0x642c28]
add al, 4
push str.SoftwareMail.RuAgent
push 0x80000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], bl
mov dword [esp + 0x20], ebx
call fcn.0046e420
mov eax, dword [esp + 0xa4]
add esp, 0x10
mov edx, str.Tahoma
mov ecx, eax
lea ecx, [ecx]
mov si, word [ecx]
cmp si, word [edx]
jne 0x4696d6
cmp si, bx
je 0x4696d2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4696d6
add ecx, 4
add edx, 4
cmp si, bx
jne 0x4696b0
xor ecx, ecx
jmp 0x4696db
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
jne 0x469712
cmp dword [0x646454], ebx
je 0x469712
cmp dword [esp + 0x10], ebx
je 0x469712
xor eax, eax
nop
movzx ecx, word [eax + str.Segoe_UI]
mov word [esp + eax + 0x30], cx
add eax, 2
cmp cx, bx
jne 0x4696f0
push 0x48
push 0x60
dec edi
push edi
call ebp
mov dword [esp + 0x14], eax
jmp 0x46977f
mov edx, str.TahomaConst
mov ecx, eax
lea esp, [esp]
mov si, word [ecx]
cmp si, word [edx]
jne 0x469746
cmp si, bx
je 0x469742
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x469746
add ecx, 4
add edx, 4
cmp si, bx
jne 0x469720
xor ecx, ecx
jmp 0x46974b
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
jne 0x469767
xor eax, eax
movzx ecx, word [eax + 0x5d22f8]
mov word [esp + eax + 0x30], cx
add eax, 2
cmp cx, bx
jne 0x469751
jmp 0x46977f
lea edx, [esp + 0x30]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x469770
mov ebx, dword [esp + 0x80]
mov ecx, 0x17
lea esi, [esp + 0x14]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0x94]
call fcn.0042ee10
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x46a040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5be7a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
mov ebp, dword [esp + 0x30]
mov ecx, ebp
call fcn.0042ecc0
mov dword [esp + 0x28], esi
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
dec eax
or eax, ecx
mov dword [esp + 0x1c], 1
jge 0x46a09e
push 1
mov ecx, ebp
call fcn.004025e0
mov ecx, dword [ebx + 0x50]
mov edi, dword [ebp]
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
cmp word [ecx], si
je 0x46a18f
mov dword [esp + 0x10], 2
jmp 0x46a0c5
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x46a0f4
mov edx, dword [ebx + 0x50]
movzx eax, word [edx]
push eax
call fcn.0050faed
add esp, 4
test eax, eax
jne 0x46a0e9
mov ecx, dword [ebx + 0x50]
cmp word [ecx], 0x5f
jne 0x46a18f
mov edx, dword [ebx + 0x50]
mov ax, word [edx]
mov word [edi], ax
jmp 0x46a132
jle 0x46a18f
mov ecx, dword [ebx + 0x50]
movzx edx, word [ecx]
push edx
call fcn.0050faed
add esp, 4
test eax, eax
jne 0x46a129
mov eax, dword [ebx + 0x50]
movzx ecx, word [eax]
push ecx
call fcn.0050fb6e
add esp, 4
test eax, eax
jne 0x46a129
mov edx, dword [ebx + 0x50]
cmp word [edx], 0x5f
jne 0x46a18f
mov eax, dword [ebx + 0x50]
mov cx, word [eax]
mov word [edi], cx
mov edx, dword [esp + 0x10]
add edi, 2
mov esi, edi
sub esi, dword [esp + 0x18]
lea eax, [edx - 1]
sar esi, 1
cmp esi, eax
jl 0x46a17a
mov eax, dword [ebp]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edx
or eax, ecx
jge 0x46a16b
push edx
mov ecx, ebp
call fcn.004025e0
mov edx, dword [esp + 0x10]
mov edi, dword [ebp]
inc edx
mov dword [esp + 0x18], edi
lea edi, [edi + esi*2]
mov dword [esp + 0x10], edx
add dword [ebx + 0x50], 2
mov ecx, dword [ebx + 0x50]
inc dword [esp + 0x14]
cmp word [ecx], 0
jne 0x46a0c1
xor edx, edx
mov word [edi], dx
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test eax, eax
je 0x46a1ac
push ecx
push eax
call fcn.00511c8f
add esp, 8
test eax, eax
jl 0x46a1d7
mov ecx, dword [ebp]
cmp eax, dword [ecx - 8]
jg 0x46a1d7
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp]
pop edi
xor edx, edx
mov word [ecx + eax*2], dx
mov ecx, dword [esp + 0x1c]
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
push 0x80070057
call fcn.004013e0
int3
Function at 0x4721c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bf96c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x5d2574
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], edi
mov byte [esp + 0x14], 1
mov dword [esi + 0xc], edi
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x10]
call fcn.00422310
mov byte [esp + 0x14], 3
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4721d6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bf96c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x5d2574
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], edi
mov byte [esp + 0x14], 1
mov dword [esi + 0xc], edi
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x10]
call fcn.00422310
mov byte [esp + 0x14], 3
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x477c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c0833
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0047bf40
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea ecx, [esi + 0x3c]
mov dword [esi], 0x5d29a8
call fcn.0042ecc0
mov al, 1
mov byte [esp + 0x14], al
or ecx, 0xffffffff
mov byte [esi + 0x59], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x48], al
mov dword [esi + 0x55], ebx
mov dword [esi + 0x51], ebx
mov dword [esi + 0x4d], ebx
mov dword [esi + 0x49], ebx
mov byte [esi + 0x5a], al
mov byte [esi + 0x5b], bl
mov byte [esi + 0x5c], bl
mov byte [esi + 0x63], bl
mov byte [esi + 0x62], bl
mov dword [esi + 0x64], ecx
mov dword [esi + 0x69], ebx
mov dword [esi + 0x76], 4
mov byte [esi + 0x71], bl
mov dword [esi + 0x6d], ebx
mov dword [esi + 0x72], ebx
mov byte [esi + 0x7a], al
mov byte [esi + 0x7b], al
mov dword [esi + 0x5d], ebx
mov byte [esi + 0x68], al
mov byte [esi + 0x61], bl
mov byte [esi + 0x7c], bl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x477f19
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c087b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047bf40
mov dword [esp + 0x1c], 0
lea ebp, [esi + 0x3c]
mov ecx, ebp
mov dword [esi], 0x5d29a8
call fcn.0042ecc0
mov byte [esp + 0x1c], 1
mov edi, dword [esp + 0x24]
sub esp, 0x24
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
call fcn.004573d0
mov byte [esp + 0x40], 2
mov byte [esp + 0x40], 1
mov ecx, esi
call fcn.004589c0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x44]
lea edx, [edi + 0x3c]
mov dword [esi + 0x44], ecx
push edx
mov ecx, ebp
call fcn.00430b50
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
movzx ecx, byte [edi + 0x48]
mov byte [esi + 0x48], cl
mov edx, dword [edi + 0x49]
mov dword [esi + 0x49], edx
mov eax, dword [edi + 0x4d]
mov dword [esi + 0x4d], eax
mov ecx, dword [edi + 0x51]
mov dword [esi + 0x51], ecx
mov edx, dword [edi + 0x55]
mov dword [esi + 0x55], edx
mov eax, dword [edi + 0x5d]
mov dword [esi + 0x5d], eax
mov ecx, dword [edi + 0x6d]
mov dword [esi + 0x6d], ecx
movzx edx, byte [edi + 0x5a]
mov byte [esi + 0x5a], dl
movzx eax, byte [edi + 0x5b]
mov byte [esi + 0x5b], al
movzx ecx, byte [edi + 0x5c]
mov byte [esi + 0x5c], cl
movzx edx, byte [edi + 0x59]
mov byte [esi + 0x59], dl
movzx eax, byte [edi + 0x63]
mov byte [esi + 0x63], al
movzx ecx, byte [edi + 0x62]
mov byte [esi + 0x62], cl
mov edx, dword [edi + 0x64]
mov dword [esi + 0x64], edx
mov eax, dword [edi + 0x69]
mov dword [esi + 0x69], eax
mov ecx, dword [edi + 0x76]
mov dword [esi + 0x76], ecx
movzx edx, byte [edi + 0x71]
mov byte [esi + 0x71], dl
mov eax, dword [edi + 0x72]
mov dword [esi + 0x72], eax
movzx ecx, byte [edi + 0x7a]
mov byte [esi + 0x7a], cl
movzx edx, byte [edi + 0x7b]
mov byte [esi + 0x7b], dl
movzx eax, byte [edi + 0x68]
mov byte [esi + 0x68], al
movzx ecx, byte [edi + 0x61]
mov byte [esi + 0x61], cl
movzx edx, byte [edi + 0x7c]
mov byte [esi + 0x7c], dl
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret 4
Function at 0x480c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
mov edx, dword [esp + 0xc]
push 0x5c0e58
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
xor eax, eax
push edi
mov ebx, ecx
test edx, edx
jl 0x480e70
cmp edx, 0x36
jb 0x480e70
mov ebp, dword [esp + 0x38]
mov ecx, dword [ebp + 0xe]
mov esi, dword [ebp + 0x2e]
add ebp, 0xe
add ecx, 0xe
lea ecx, [ecx + esi*4]
mov dword [esp + 0x10], ecx
cmp edx, ecx
jb 0x480e70
push 0x7c
push eax
lea edi, [ebx + 0x91]
push edi
call fcn.0050eca0
mov esi, ebp
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 4]
mov dword [ebx + 0x115], eax
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x119], ecx
mov dx, word [ebp + 0xe]
shr dx, 3
mov byte [ebx + 0x11d], dl
movzx eax, word [ebp + 0xe]
imul eax, dword [ebp + 4]
add eax, 0x1f
and eax, 0xffffffe0
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x44]
add eax, 0xe
sar ebp, 3
imul ebp, dword [eax + 8]
mov eax, dword [esp + 0x1c]
lea ecx, [eax + ebp]
add esp, 0xc
cmp dword [esp + 0x3c], ecx
jb 0x480e6e
push 0x7c
xor edi, edi
push edi
lea esi, [ebx + 0x91]
push esi
call fcn.0050eca0
mov edx, dword [ebx + 0x115]
mov eax, dword [ebx + 0x119]
mov dword [ebx + 0x95], edx
movzx dx, byte [ebx + 0x11d]
neg eax
add dx, dx
mov dword [ebx + 0x99], eax
add dx, dx
lea eax, [ebp + 0x7c]
mov ecx, 1
add dx, dx
push eax
mov dword [esi], 0x7c
mov word [ebx + 0x9d], cx
mov word [ebx + 0x9f], dx
mov dword [ebx + 0xa1], edi
mov dword [ebx + 0xc9], edi
mov dword [ebx + 0x10d], eax
call fcn.00510ac5
mov dword [ebx + 0x111], eax
mov ecx, 0x1f
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movzx esi, byte [ebx + 0x11d]
imul esi, dword [ebx + 0x115]
mov edi, dword [ebx + 0x111]
add esi, 3
and esi, 0xfffffffc
sub ebp, esi
add ebp, dword [esp + 0x20]
add esp, 0x10
add ebp, dword [esp + 0x38]
add edi, 0x7c
cmp dword [ebx + 0x119], 0
mov dword [esp + 0x38], 0
jle 0x480df0
mov edi, edi
push esi
push ebp
push edi
call fcn.005114f0
mov eax, dword [esp + 0x44]
inc eax
add esp, 0xc
add edi, esi
sub ebp, esi
cmp eax, dword [ebx + 0x119]
mov dword [esp + 0x38], eax
jl 0x480dd0
mov eax, dword [ebx + 0x119]
mov ecx, dword [ebx + 0x115]
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x24]
call fcn.00494c20
xor ecx, ecx
mov dword [esp + 0x30], ecx
cmp eax, ecx
je 0x480e18
lea ecx, [eax + 4]
mov esi, dword [ecx]
mov edx, dword [ebx]
mov edx, dword [edx + 0x60]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov ecx, ebx
call edx
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00494bb0
mov byte [ebx + 0x12d], 1
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x4881e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
jbe 0x488211
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x634128]
inc ecx
cmp ecx, edx
jb 0x4881f4
pop edi
pop esi
ret

Function at 0x48bb10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x5c1a03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 0x14], 0
push 0x14
call fcn.004cb075
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov byte [esp + 0x14], 1
test esi, esi
je 0x48bbb0
push 0
lea ecx, [esp + 0x20]
call fcn.0042f8a0
push eax
call fcn.00541a9b
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esi], 0x5d3100
mov dword [esi + 4], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
call dword [0x5c9428]
mov dword [esi + 8], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x48acd0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00512cdd
add esp, 0x18
push eax
call dword [0x5c9530]
jmp 0x48bbb2
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0042ee10
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x490010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c1ff8
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov eax, ebp
push edi
mov esi, ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x490036
sub eax, edx
sar eax, 1
add eax, 0x400
push eax
lea ecx, [esp + 0x24]
call fcn.00419a50
mov dword [esp + 0x40], 0
cmp dword [esi + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x48], 0
jne 0x490076
xor edi, edi
jmp 0x490079
mov edi, dword [esi + 0xc]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x2c]
sar eax, 1
jne 0x49008a
call fcn.0050eb52
push edi
push 1
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
push ebp
call fcn.004532a0
add esp, 0x1c
test eax, eax
mov eax, dword [esp + 0x48]
je 0x49010b
test eax, eax
je 0x49010b
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.0048b7c0
mov esi, eax
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00419460
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret 8
mov dword [esi + 0x50], 0x65
test eax, eax
jne 0x49011d
mov dword [esi + 0x50], 0x66
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00419460
mov ecx, dword [esp + 0x38]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebp
add esp, 0x38
ret 8
Function at 0x4a26b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x4a285a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x4a2708
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x4a271b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x4a272f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x4a2776.3
jmp 0x4a2740
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x4a274c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x4a2751
mov esi, 1
inc eax
cmp eax, edi
jl 0x4a2740
cmp si, cx
je case.0x4a2776.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4a2776.3
movzx eax, byte [eax + 0x4a2874]
jmp dword [eax*4 + 0x4a2860]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x4a2776.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4a2790
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, pe_nt_image_headers32
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x4a2776.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x4a27d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4a2776.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x4a27f6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4a2776.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x4a2820
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4ad1c0
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 0x24
mov eax, edx
shr eax, 1
test dl, 1
je 0x4ad1d3
xor eax, 0xedb88320
test al, 1
je 0x4ad1e0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad1e2
shr eax, 1
test al, 1
je 0x4ad1ef
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad1f1
shr eax, 1
test al, 1
je 0x4ad1fe
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad200
shr eax, 1
test al, 1
je 0x4ad20d
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad20f
shr eax, 1
test al, 1
je 0x4ad21c
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad21e
shr eax, 1
test al, 1
je 0x4ad22b
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad22d
shr eax, 1
test al, 1
je 0x4ad23a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad23c
shr eax, 1
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jb 0x4ad1c5
ret

Function at 0x4ad250
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test edx, edx
jbe 0x4ad27d
push ebx
push ebp
movzx ebx, byte [esi]
movzx ebp, al
xor ebx, ebp
shr eax, 8
xor eax, dword [ecx + ebx*4 + 0x24]
dec edx
inc esi
test edx, edx
ja 0x4ad266
pop ebp
pop ebx
mov dword [edi], eax
pop edi
pop esi
ret 0xc