joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5ab0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70f45c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [eax], dx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 2]
mov word [eax + 2], dx
mov eax, dword [ebp + 8]
mov cx, word [eax + 4]
mov edx, dword [ebp - 0x10]
mov word [edx + 4], cx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ecx + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp + 8]
add edx, 0x24
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004eb9fc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004e5b90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e9270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70f9cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004e9340
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004125e0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004e9de0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004125e0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004e9de0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004e9de0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004e9de0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004e9de0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004e9200
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004e9de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e9530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70fb3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004e64a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004e9640
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004e64a0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004e64a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004e64a0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004e64a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004e64a0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004e64a0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004b6b70
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004e9610
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4f8157
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004b7c40
add esp, 8
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4fbcba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0x4fbcd2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jae 0x4fbd04
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4 + 0x3c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + eax*4 + 0x30], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4 + 0x24], 0
jmp 0x4fbcc9
mov dword [ebp - 4], 0
jmp 0x4fbd16
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x4fbd50
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x18
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
call dword [eax + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4 + 0x68], 0
jmp 0x4fbd0d
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
mov esp, ebp
pop ebp
ret
Function at 0x50e6b5
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x710ac3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00511440
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00511460
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.00511120
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
call fcn.004f0e80
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.00511480
mov ecx, dword [ebp - 0x18]
add ecx, 0x14
call fcn.005114a0
mov ecx, dword [ebp - 0x18]
add ecx, 0x18
call fcn.004b97a0
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.004e64a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.004e64a0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x2c
call fcn.004e64a0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
add ecx, 0x30
call fcn.004e64a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
add ecx, 0x34
call fcn.004e64a0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
add ecx, 0x38
call fcn.0050e1f0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
add ecx, 0x58
call fcn.004eb948
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x72], 1
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x73], 1
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x74], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xa0
call fcn.004e64a0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0xa4
call fcn.004e64a0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x7282c4
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], 0x7282b4
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], 0x7282a4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc], 0x728294
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0x728280
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x728270
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.005969b0
push 0x30
call fcn.0044f661
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x14], 0
je 0x50e82e
mov ecx, dword [ebp - 0x14]
call fcn.004f0af0
mov dword [ebp - 0x1c], eax
jmp 0x50e835
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0xb4], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xb4]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xa4
call fcn.005969b0
call fcn.0050e5c0
mov edx, dword [ebp - 0x18]
mov byte [edx + 0xb0], al
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x516880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x711289
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004ecc41
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004eb9fc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov edx, dword [edx + 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x30], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x34], eax
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x40]
mov byte [eax + 0x40], dl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x518ac0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x518ad8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x518b2d
mov ecx, dword [ebp - 4]
shl ecx, 0x18
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x518afc
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x518b1e
mov eax, dword [ebp - 8]
shl eax, 1
mov ecx, dword [ebp - 8]
shr ecx, 0x1f
xor edx, edx
sub edx, ecx
and edx, 0x4c11db7
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x518af3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x7db338], ecx
jmp 0x518acf
mov esp, ebp
pop ebp
ret

Function at 0x518c3f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.006fb1d7
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00518c74
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x518c96
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.006fb1d7
add esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00518c74
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x518cff
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x518cff
call fcn.00518b9f
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x51a485
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp + 8]
mov byte [edx + 0x1f], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x468], 0xffffffff
mov dword [edx + 0x46c], 0xffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.0051a543
add esp, 4
mov dword [ebp - 4], 0
jmp 0x51a4ee
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x100
jae 0x51a53f
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
jmp 0x51a50f
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jae 0x51a530
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp - 8]
and edx, 1
xor eax, eax
sub eax, edx
and eax, 0xedb88320
xor ecx, eax
mov dword [ebp - 8], ecx
jmp 0x51a506
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x60], eax
jmp 0x51a4e5
mov esp, ebp
pop ebp
ret
Function at 0x51b723
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 3
jae 0x51b74c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051b207
add esp, 4
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
jmp 0x51b850
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jbe 0x51b775
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x1c]
lea ecx, [edx + eax*4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [edx + 2]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
shl edx, 8
or eax, edx
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx + 1]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx + edx*4 + 0x60]
and eax, 0xffff
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x51b7b3
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 8]
jne 0x51b850
mov edx, dword [ebp + 8]
push edx
call fcn.0051b0f0
add esp, 4
cmp dword [ebp + 0xc], 0
jne 0x51b729
mov esp, ebp
pop ebp
ret
Function at 0x526b3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
or ah, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
and ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
shr edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
neg eax
and eax, 0x7ff
xor edx, eax
shr edx, 4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ecx + edx*4]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 2
jae 0x526b53
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x526b98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x100
mov eax, dword [ebp + 0xc]
or ah, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
shl ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
and edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, edx
mov ecx, dword [ebp + 0xc]
shr ecx, 8
add eax, ecx
mov edx, dword [ebp + 8]
xor ecx, ecx
mov cx, word [edx + eax*2]
mov edx, dword [ebp + 0xc]
shr edx, 7
and edx, 1
neg edx
and edx, 0x7ff
xor ecx, edx
shr ecx, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
add edx, dword [eax + ecx*4]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
shl eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
xor ecx, dword [ebp + 0xc]
not ecx
mov edx, dword [ebp - 4]
and edx, ecx
mov dword [ebp - 4], edx
cmp dword [ebp + 0xc], 0x10000
jb 0x526bb5
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x52c648
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0xffffffff
mov byte [ebp - 0xc], 0
mov byte [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x52c67b
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x52c693
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
xor dl, byte [ecx]
mov byte [ebp - 4], dl
jmp 0x52c672
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
jne 0x52c6d8
cmp dword [ebp + 0xc], 0
je 0x52c6d8
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 4], 1
mov byte [ebp - 0xc], 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0052c6e1
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jl 0x52c6d1
mov al, 1
jmp 0x52c6db
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x52dfcf
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0x6a09e667
mov edx, dword [ebp + 8]
mov dword [edx + 0x24], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0x3c6ef372
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], 0xa54ff53a
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0x9b05688c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 0x1f83d9ab
mov edx, dword [ebp + 8]
mov dword [edx + 0x3c], 0x5be0cd19
pop ebp
ret

Function at 0x52ecd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov dword [ebp - 0xcc], ecx
lea eax, [ebp - 0x84]
push eax
call fcn.0052e035
add esp, 4
mov dword [ebp - 4], 0x3e8
mov dword [ebp - 0xac], 0x64
mov dword [ebp - 0xb0], 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xa8], eax
push 4
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052e97d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xa8], eax
push 4
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.0052e97d
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x52edd0
push str.SystemFunction036
mov edx, dword [ebp - 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x52edc3
push 0x20
lea eax, [ebp - 0xa4]
push eax
call dword [ebp - 0xb8]
and eax, 0xff
test eax, eax
je 0x52edc3
mov dword [ebp - 4], 0x64
push 0x20
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052e97d
add esp, 0xc
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x52edf9
push 8
lea edx, [ebp - 0xc4]
push edx
lea eax, [ebp - 0x84]
push eax
call fcn.0052e97d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xbc], eax
push 4
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052e97d
add esp, 0xc
mov dword [ebp - 0xc8], 0
jmp 0x52ee38
mov eax, dword [ebp - 0xc8]
add eax, 1
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x64
jae 0x52ee80
mov ecx, dword [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052ea85
add esp, 8
lea eax, [ebp - 0x84]
push eax
call fcn.0052e035
add esp, 4
push 0x20
mov ecx, dword [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052e97d
add esp, 0xc
jmp 0x52ee29
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52edd0
mov ecx, dword [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0052ea85
add esp, 8
mov eax, dword [ebp - 0xcc]
mov byte [eax + 0x20], 0
mov esp, ebp
pop ebp
ret
Function at 0x53c1ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push 0x40
mov eax, dword [ebp + 0xc]
and eax, 0xff
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.00455470
add esp, 0xc
mov dword [ebp - 0xc4], 0
jmp 0x53c22a
mov edx, dword [ebp - 0xc4]
add edx, 1
mov dword [ebp - 0xc4], edx
cmp dword [ebp - 0xc4], 0x14
jae 0x53c25a
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov dl, byte [ebp + ecx - 0xc0]
xor dl, byte [eax]
mov eax, dword [ebp - 0xc4]
mov byte [ebp + eax - 0xc0], dl
jmp 0x53c21b
lea ecx, [ebp - 0x80]
call fcn.0053ca80
push 0x40
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.0053bd70
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x80]
call fcn.0053caa0
mov esp, ebp
pop ebp
ret

Function at 0x544320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x711a75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0053b550
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00594310
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x19], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x1a], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1b], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x1d], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004eca57
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], 0x40000000
mov dword [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x546b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x711c3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004e5650
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004b97a0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004e64a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xd], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004e64a0
mov edx, dword [ebp - 0x10]
mov dword [edx], 0x728a30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret