joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48df00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x56000]
push edi
jmp 0x48df1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48df21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48df10
mov eax, 1
add ebx, ebx
jne 0x48df33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48df44
jne 0x48df63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48df63
dec eax
add ebx, ebx
jne 0x48df50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48df28
add ebx, ebx
jne 0x48df5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48dfb5
xor ecx, ecx
sub eax, 3
jb 0x48df7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48dfea
sar eax, 1
mov ebp, eax
jmp 0x48df86
add ebx, ebx
jne 0x48df86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48df54
inc ecx
add ebx, ebx
jne 0x48df94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48df54
add ebx, ebx
jne 0x48dfa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48df96
jne 0x48dfb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48df96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48dfd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48dfc6
jmp 0x48df16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48dfd4
add edi, ecx
jmp 0x48df16
pop esi
mov edi, esi
mov ecx, 0x2c6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48dff2
cmp byte [edi], 0x11
jne 0x48dff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48dff7
lea edi, [esi + 0x8a000]
mov eax, dword [edi]
or eax, eax
je 0x48e06f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9613c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x96254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48e024
mov ecx, edi
jns 0x48e053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x96258]
or eax, eax
je 0x48e069
mov dword [ebx], eax
add ebx, 4
jmp 0x48e041
call dword [esi + 0x96268]
mov ebp, dword [esi + 0x9625c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48e0a3
sub esp, 0xffffff80
jmp 0x454bde
Function at 0x4174cf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4d93a0
call fcn.004d3620
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.004d2544
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [ebp - 4], ebx
call fcn.004d2544
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004d2544
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.004d2544
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call fcn.004d2544
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call fcn.004d2544
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.004d2544
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.004d2544
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 7
call fcn.004d2544
push 5
mov ecx, dword [ebp - 0xc]
pop eax
mov dword [esi + 0x18], ebx
push 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
pop eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x68], eax
mov dword [esi], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], 0x20
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov byte [esi + 0x80], bl
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4174db
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4d93a0
call fcn.004d3620
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.004d2544
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [ebp - 4], ebx
call fcn.004d2544
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004d2544
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.004d2544
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call fcn.004d2544
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call fcn.004d2544
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.004d2544
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.004d2544
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 7
call fcn.004d2544
push 5
mov ecx, dword [ebp - 0xc]
pop eax
mov dword [esi + 0x18], ebx
push 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
pop eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x68], eax
mov dword [esi], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], 0x20
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov byte [esi + 0x80], bl
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41b923
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4d9dc0
call fcn.004d3620
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [edi + 4]
push eax
call fcn.004d2580
and dword [ebp - 4], 0
lea eax, [edi + 8]
push eax
lea ecx, [esi + 8]
call fcn.004d2580
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.004d2580
mov eax, dword [edi + 0x10]
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.004d2580
mov eax, dword [edi + 0x18]
lea ecx, [esi + 0x34]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
mov byte [ebp - 4], 3
call fcn.004d2580
lea eax, [edi + 0x38]
lea ecx, [esi + 0x38]
push eax
mov byte [ebp - 4], 4
call fcn.004d2580
mov eax, dword [edi + 0x3c]
lea ecx, [esi + 0x48]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
lea eax, [edi + 0x48]
push eax
mov byte [ebp - 4], 5
call fcn.004d2580
mov eax, dword [edi + 0x4c]
lea ecx, [esi + 0x58]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
lea eax, [edi + 0x58]
push eax
mov byte [ebp - 4], 6
call fcn.004d2580
mov eax, dword [edi + 0x5c]
lea ecx, [esi + 0x7c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
lea eax, [edi + 0x7c]
push eax
mov byte [ebp - 4], 7
call fcn.004d2580
mov al, byte [edi + 0x80]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x80], al
mov eax, dword [edi + 0x84]
mov dword [esi + 0x84], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x450776
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4de968
call fcn.004d3620
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
push 0x10
mov dword [ebp - 4], ebx
pop eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi], 0x4f2780
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 0xfa
mov dword [esi + 0x14], ebx
call fcn.00451901
push 0x54
xor eax, eax
pop ecx
lea edi, [ebp - 0x160]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x164]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x18], ebx
mov dword [ebp - 0x164], 0x154
call dword [0x4eb490]
lea eax, [ebp - 0xc4]
push eax
call dword [0x4ea154]
mov edi, dword [0x4eb4b8]
push 7
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0xffffff
call edi
push 0xe
mov dword [esi + 0x38], eax
call edi
push 0xf
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x40], eax
mov eax, dword [0x51a124]
push 0xd
mov dword [esi + 0x44], eax
call edi
push 0x14
mov dword [esi + 0x48], eax
call edi
push 0x10
mov dword [esi + 0x4c], eax
call edi
push 0x11
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0xe0aa79
push 0xf
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
call edi
push 0x14
mov dword [esi + 0x58], eax
call edi
push 0x10
mov dword [esi + 0x5c], eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x60], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4746ce
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [0x4eb5d8]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x474708
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x474705
push 0x10
xor eax, eax
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 0x10]
sub eax, 0x61c88647
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
add ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add dword [ebp + 8], edx
dec ecx
jne 0x47471c
mov esi, dword [0x4eb5dc]
push ebx
call esi
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47495f
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [0x4eb5d8]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov dword [ebp + 8], eax
call esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x474999
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x474996
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
sub ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 0x10]
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add eax, 0x61c88647
sub dword [ebp + 8], edx
dec ecx
jne 0x4749b0
push dword [ebp + 8]
mov esi, dword [0x4eb5dc]
call esi
mov edi, dword [ebp + 0x10]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x474f2c
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004d3790
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x475c13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
test edx, edx
je 0x475d36
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x475d36
mov eax, dword [ebp + 8]
push ebx
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x475d13
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4f64dc]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f64dc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f64dc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f64dc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f64dc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f64dc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f64dc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4f64dc]
xor eax, esi
inc edx
dec edi
jne 0x475c51
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x475d30
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x4f64dc]
xor eax, edi
inc edx
dec esi
jne 0x475d17
pop edi
pop ebx
not eax
jmp 0x475d39
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x475d7b
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call fcn.004d5518
push dword [esi + 4]
mov edi, eax
call fcn.004d5518
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
lea esi, [ebp - 0x10]
sub eax, ecx
mov dword [ebp + 8], 4
mov dword [ebp + 0xc], eax
jmp 0x475db4
mov eax, dword [ebp + 0xc]
push dword [eax + esi]
call fcn.004d5518
mov dword [esi], eax
add esi, 4
dec dword [ebp + 8]
jne 0x475db1
push 0x10
xor eax, eax
pop ecx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 0xc]
sub eax, 0x61c88647
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add edi, edx
mov edx, edi
mov esi, edi
shr edx, 5
add edx, dword [ebp - 4]
shl esi, 4
add esi, dword [ebp - 8]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
add ebx, edx
dec ecx
jne 0x475dcb
push edi
call fcn.004d5512
mov esi, dword [ebp + 0x10]
push ebx
mov dword [esi], eax
call fcn.004d5512
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x475e1e
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call fcn.004d5518
push dword [esi + 4]
mov ebx, eax
call fcn.004d5518
mov edi, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
lea esi, [ebp - 0x10]
sub eax, ecx
mov dword [ebp + 8], 4
mov dword [ebp + 0xc], eax
jmp 0x475e57
mov eax, dword [ebp + 0xc]
push dword [eax + esi]
call fcn.004d5518
mov dword [esi], eax
add esi, 4
dec dword [ebp + 8]
jne 0x475e54
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 4]
shl esi, 4
add esi, dword [ebp - 8]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
sub edi, edx
mov edx, edi
mov esi, edi
shr edx, 5
add edx, dword [ebp - 0xc]
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
add eax, 0x61c88647
sub ebx, edx
dec ecx
jne 0x475e71
push ebx
call fcn.004d5512
mov esi, dword [ebp + 0x10]
push edi
mov dword [esi], eax
call fcn.004d5512
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4766b6
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x4773e2
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x4820a9
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004d3790
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x48a2a8
Capabilities:
Encode data using xor

Disassembly:
fbstp tbyte [edx]
bound esi, qword [ecx + 0x20]
salc
rcl al, 1
lds edi, [ecx - 0x5c4d4f06]
mov edx, 0xceb4d7ca
mov al, 0xbc
mov dh, 0xce
stosb byte es:[edi], al
aam 0xf6
mov bl, 0xd6
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], dl
xor esp, dword [edx + 0x71]
and byte [ebx - 0x3d383547], bh
aad 0xfd
mov ecx, 0x21c3bac9
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop ds
xor esp, dword [edx + 0x71]
and ch, dl
loop 0x48a382
invalid
Function at 0x4cd940
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword [ecx + 8]
sub eax, edx
sar eax, 3
mov edx, dword [esi + 0x450]
add edx, eax
cmp edx, 0x64
jae 0x4cda35
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4cda35
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 8]
push edx
push 1
push eax
invalid
jg 0x4cd98a
invalid

Function at 0x4ceae4
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.004ce7d8
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
add byte [eax], al
add byte [ebx + 0x134a1], al
add byte [eax], al
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x4ceb12
mov esi, 0x3e8
call fcn.004cea62
dec esi
jne 0x4ceb43
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4ceafb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.004ce7d8
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
add byte [eax], al
add byte [ebx + 0x134a1], al
add byte [eax], al
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x4ceb12
mov esi, 0x3e8
call fcn.004cea62
dec esi
jne 0x4ceb43
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d28f8
Capabilities:
Encode data using xor

Disassembly:
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x14]
lea ebx, [ebp - 0x1c]
lea edi, [ebp - 0x1c]
mov dword [ebp - 4], 1
and dword [eax], 0
sub ebx, dword [ebp + 0x10]

Function at 0x4d29fa
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp + 0x10], ecx
dec ebp
adc byte [ebx + 0x7d8308eb], al
jge 0x4d2a14
invalid
jne 0x4d2994

Function at 0x4d2a6c
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x1c]
add dword [eax], 8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp + 0x10], ecx
sub ebx, 8

Function at 0x4d2ac6
Capabilities:
Encrypt data using tea

Disassembly:
push ebx
push esi
mov esi, dword [0x10048140]
add al, 0x10