joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dff0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x49f4c5
call fcn.0049b0e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00428bc5
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040283d
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040283d
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040283d
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040283d
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x434dae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x49fc6d
call fcn.0049b0e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402f14
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402f14
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402f14
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00402f14
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x439b89
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x4a02f6
call fcn.0049b0e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4a7708
mov dword [esi + 4], 0x4a5d28
mov dword [esi + 8], 0x4a5d5c
mov dword [esi + 0xc], 0x4a67f0
mov dword [esi + 0x10], 0x4a76f4
mov dword [esi + 0x14], 0x4a76e4
mov dword [esi + 0x18], 0x4a5d4c
mov dword [esi + 0x1c], 0x4a5d3c
mov dword [esi + 0x20], 0x4a76dc
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.00402e41
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402e41
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 6
call fcn.00402e41
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
or dword [esi + 0xa8], 0xffffffff
mov byte [ebp - 4], 8
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xac], ebx
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov byte [esi + 0xb2], bl
mov byte [esi + 0xb3], bl
mov byte [esi + 0xb4], bl
mov byte [esi + 0xb5], bl
mov byte [esi + 0xb6], bl
mov byte [esi + 0xb7], bl
mov dword [esi + 0xb8], ebx
mov dword [esi], 0x4a76b0
mov dword [esi + 4], 0x4a769c
mov dword [esi + 8], 0x4a7684
mov dword [esi + 0xc], 0x4a7668
mov dword [esi + 0x10], 0x4a7654
mov dword [esi + 0x14], 0x4a7644
mov dword [esi + 0x18], 0x4a7634
mov dword [esi + 0x1c], 0x4a7624
mov dword [esi + 0x20], 0x4a761c
call fcn.0041ba7d
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x446e64
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4a14db
call fcn.0049b0e0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.00402e41
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44af2b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a19c8
call fcn.0049b0e0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00457599
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.004397d0
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.004397d0
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.004397d0
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.004397d0
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.004397d0
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.004397d0
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.004397d0
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.004397d0
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44fba9
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x44fc05
cmp word [ecx], 0x5a4d
jne 0x44fc05
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x44fc05
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x44fc05
test al, 7
jne 0x44fc05
add eax, ecx
cmp dword [eax], 0x4550
jne 0x44fc05
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x44fc1f
sub ecx, 0x74
je 0x44fc18
dec ecx
dec ecx
je 0x44fc18
dec ecx
dec ecx
je 0x44fc11
sub ecx, 0x3c
je 0x44fc0a
sub ecx, 0x8464
je 0x44fc1f
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x44fc24
mov ecx, 0x3030701
jmp 0x44fc24
mov ecx, 0x3030501
jmp 0x44fc24
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x44fc05
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x44fc3e
cmp eax, 0x20b
jne 0x44fc05
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x44fc07

Function at 0x4536ba
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a1fe3
call fcn.0049b0e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00453974
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00453a4d
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.00402f14
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x454079
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x454098
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x454087
pop edi
cmp esi, 4
jb 0x4540a2
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x4540b3
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x4540bf
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x4540c9
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x4605ed
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x4a2e47
call fcn.0049b0e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.0040283d
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.00460670
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x468fc2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4a33a0
call fcn.0049b0e0
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.00469033
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x30]
push eax
call fcn.00465b7a
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x50]
push eax
call fcn.00465b7a
push dword [ebp - 0x1c]
call fcn.00401def
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46fc10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0046f2c0
push 0x41
mov ecx, esi
call fcn.0046f2c0
push 0x59
mov ecx, esi
call fcn.0046f2c0
push 0x26
mov ecx, esi
call fcn.0046f2c0
push 0x53
mov ecx, esi
call fcn.0046f2c0
push 0x59
mov ecx, esi
call fcn.0046f2c0
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x46fca0
test cl, cl
jbe 0x46fc9c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x4baa34]
xor eax, edi
dec ecx
jne 0x46fc86
xor edi, edi
jmp 0x46fccf
cmp bl, cl
jne 0x46fca7
inc edi
jmp 0x46fcb2
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x4baa34]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x46fc5e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0046f300
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0046f420
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x46fee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.0046fd10
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a8], bl
je 0x46ff5c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.00493380
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x46ff99
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x46ff6e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00470070
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a8], bl
je 0x470059
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x46ffe4
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x470035
lea ecx, [edi + 0x148]
call fcn.0040e29c
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.004934a0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x47dfe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x47e01e
mov ecx, ebx
call fcn.00499f20
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.0049aed0
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.0049a620
jmp 0x47e036
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x47e03f
mov ecx, ebx
call fcn.00499f20
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.0049aed0
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x47e06d
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.00499f20
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0049aed0
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x47e0e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.0049a700
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.0049a700
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x47e1ba
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0049a760
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.0049a760
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x47e14f
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x47e7b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0049a8b0
mov ebp, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049aed0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049aed0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x47e84b
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47e844
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x47e844
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.0049aed0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x47e86f
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.0049aed0
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049aed0
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049af60
lea ecx, [esp + 0x1c]
call fcn.0049a8b0
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.0049aed0
dec edi
jne 0x47e889
dec ebp
jne 0x47e851
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049af60
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret

Function at 0x47f0a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x47f0d1
lea ecx, [esp + 0x4c]
call fcn.00499f20
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.0049aed0
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.0049a620
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4
Function at 0x480370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
push edi
mov ebp, ecx
xor edi, edi
and esi, 7
mov dword [esp + 0xc], ebp
cmp edx, 5
jae 0x480397
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx - 4]
add ebx, ebp
mov dword [esp + 0x14], ebx
lea edx, [edi + ebp]
cmp edx, ebx
jae 0x4803bf
lea ecx, [ecx]
mov cl, byte [edx]
and cl, 0xfe
cmp cl, 0xe8
je 0x4803bf
inc edx
cmp edx, ebx
jb 0x4803b0
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, ebp
sub edi, ebp
cmp edx, ebx
jae 0x4804ab
cmp ecx, 2
jbe 0x480417
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x48049c
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [esp + 0x1c]
lea ebp, [edi + ecx]
add edi, 5
cmp dword [esp + 0x24], 0
je 0x480440
add eax, ebp
jmp 0x480442
shr esi, cl
test esi, esi
je 0x4803d8
cmp esi, 4
ja 0x480435
cmp esi, 3
je 0x480435
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x4803d8
or esi, 8
shr esi, 1
inc edi
jmp 0x4803a6
sub eax, ebp
test esi, esi
je 0x480476
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x480470
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [esp + 0x24], 0
je 0x48046e
add eax, ebp
jmp 0x480470
sub eax, ebp
mov ebx, dword [esp + 0x14]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x4803a6
mov ebp, dword [esp + 0x10]
or esi, 8
shr esi, 1
inc edi
jmp 0x4803a6
pop ebx
cmp ecx, 2
jbe 0x4804c4
mov edx, dword [esp + 0x1c]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc
mov edx, dword [esp + 0x1c]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc

Function at 0x481940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
or eax, 0xffffffff
push esi
mov dword [ecx + 0x34], edx
mov byte [ecx + 0x1f], dl
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x468], eax
mov dword [ecx + 0x46c], eax
mov dword [ecx + 0x30], 0x20
mov dword [ecx + 0x48], 4
mov word [ecx + 0x1d], 1
lea esi, [ecx + 0x60]
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x481972
pop esi
ret