joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
push ebx
mov bl, byte [esp + 0x18]
push ebp
xor ebp, ebp
movzx eax, bl
neg eax
sbb eax, eax
push esi
mov esi, dword [esp + 0x1c]
and eax, 0x210
add eax, 0xb0
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
je 0x4d35ce
push eax
push esi
call fcn.004ee390
test al, al
jne 0x4d35ce
push 0x71
mov ecx, edi
call fcn.004cc3d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
cmp esi, ebp
jne 0x4d35e7
push 0x69
mov ecx, edi
call fcn.004cc3d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test bl, bl
jne 0x4d35f1
mov dword [esp + 0x10], esi
jmp 0x4d35f5
mov dword [esp + 0x14], esi
cmp dword [esi + 4], ebp
jne 0x4d3609
cmp dword [esi + 8], 0x186a0
jne 0x4d3609
or dword [esi], 0x10000
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
cmp byte [esp + 0x24], 0
mov ecx, edi
jne 0x4d3627
mov ebp, dword [esp + 0x10]
push ebp
push ebx
call fcn.004cf3d0
jmp 0x4d3632
mov ebp, dword [esp + 0x14]
push ebp
push ebx
call fcn.004d3330
mov ebp, dword [ebp + 0x10]
mov esi, eax
push esi
mov ecx, edi
call fcn.004cf530
test al, al
jne 0x4d3653
mov ecx, dword [esp + 0x20]
inc ecx
cmp ecx, 5
mov dword [esp + 0x20], ecx
jl 0x4d3611
jmp 0x4d3659
and esi, 0xffff
test al, al
jne 0x4d369f
mov eax, dword [0x59cfc4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4d368d
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4d368d
mov ecx, dword [0x59cfc4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x7f
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test esi, esi
je 0x4d36d4
test ebp, ebp
je 0x4d36d4
push esi
mov ecx, edi
call fcn.004d0e40
test eax, eax
je 0x4d36b7
cmp eax, ebp
jae 0x4d36d4
push esi
mov ecx, edi
call fcn.004cf640
push 0x7d
mov ecx, edi
call fcn.004cc3d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4d4380
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x545a61
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push ebp
push esi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x464]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x47c]
mov eax, dword [esp + 0x478]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x4d43ed
push ebp
push eax
call fcn.004ee390
test al, al
jne 0x4d43ed
push 0x71
mov ecx, esi
call fcn.004cc3d0
xor eax, eax
jmp 0x4d45b9
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov dword [esp + 0x40], 0x469078
mov ecx, dword [0x59cfc4]
push ecx
mov dword [esp + 0x470], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d4426
mov eax, dword [eax]
add eax, 0x2710
push eax
call fcn.004cb8d0
add esp, 4
push eax
lea ecx, [esp + 0x44]
call fcn.004b65e0
mov ebx, dword [esp + 0x474]
cmp bl, 0x10
jne 0x4d44d7
lea ecx, [esp + 0x10]
call fcn.004f5720
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x470], 1
call fcn.004b6580
push ecx
mov eax, esp
mov dword [eax], 1
mov dword [esp + 0x40], esp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 2
call fcn.004f57a0
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x1c], 0x469080
jb 0x4d44b1
mov edx, dword [esp + 0x24]
push edx
call fcn.005265f5
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x46c], 0
call fcn.004f57c0
and ebx, 0xf00
mov byte [esp + 0x45f], 0
cmp ebx, 0x100
je 0x4d4555
push 1
cmp ebx, 0x200
je 0x4d451a
push 0x3ff
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x4c]
call fcn.004b5ad0
lea eax, [esp + 0x60]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d4511
jmp 0x4d4577
push 0x200
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x4c]
call fcn.004b5620
xor edx, edx
lea eax, [esp + 0x60]
mov word [esp + 0x45e], dx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4d4540
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
jmp 0x4d457c
push 0x3ff
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x48]
call fcn.004b54c0
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d4570
sub eax, edx
lea esi, [eax + 1]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4d459b
mov eax, ebp
cmp ebp, esi
jb 0x4d458c
mov eax, esi
push eax
lea edx, [esp + 0x64]
push edx
push ecx
call fcn.00526df0
add esp, 0xc
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x40], 0x469078
jb 0x4d45b7
mov eax, dword [esp + 0x48]
push eax
call fcn.005265f5
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x464]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.00526a8a
add esp, 0x460
ret 0xc
Function at 0x4d4730
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x94
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
push 0x90
xor ebp, ebp
lea eax, [esp + 0x14]
push ebp
push eax
mov esi, ecx
call fcn.00526600
add esp, 0xc
push 0x90
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
mov ecx, esi
call fcn.004d3ec0
cmp eax, 0x90
je 0x4d47b8
mov edx, dword [0x59cfc4]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d47b8
cmp dword [eax], 0x73
jne 0x4d47b8
mov eax, dword [esp + 0xb0]
push ebp
push ebp
push eax
push ebx
push 0x101
push edi
mov ecx, esi
call fcn.004d0670
jmp 0x4d47ba
mov eax, ebp
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x94
ret 0xc

Function at 0x4d47e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
mov ebp, dword [esp + 0xb4]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0xb8]
push 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0x20
push edi
mov esi, ecx
xor ebx, ebx
call fcn.004d3ec0
cmp eax, 0x10
jne 0x4d4898
cmp word [esp + 0x10], bx
je 0x4d4898
push 0x90
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.00526600
add esp, 0xc
push 0x90
lea edx, [esp + 0x24]
push edx
push 1
push edi
mov ecx, esi
call fcn.004d3ec0
cmp eax, 0x90
je 0x4d4894
mov eax, dword [0x59cfc4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d4894
cmp dword [eax], 0x73
jne 0x4d4894
mov ecx, dword [esp + 0xc0]
push ebx
push ebx
push ecx
push ebp
push 0x102
push edi
mov ecx, esi
call fcn.004d0670
mov ebx, eax
mov eax, ebx
jmp 0x4d48d0
mov edx, dword [0x59cfc4]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4d48c8
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4d48c8
mov eax, dword [0x59cfc4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0xa4
ret 0xc
Function at 0x4d8640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x52fc
call fcn.005277b0
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x52f8], eax
push ebx
mov ebx, dword [esp + 0x530c]
push esi
mov esi, dword [esp + 0x5308]
push edi
push 0x2c0
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00526600
lea ecx, [esp + 0x20]
push ecx
push 0
mov dword [esp + 0x28], 0x80000
call fcn.004b98c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4d8750
push 0x5030
lea edx, [esp + 0x2d8]
push 0
push edx
call fcn.00526600
mov ecx, dword [esp + 0x531c]
push 0x5030
lea eax, [esp + 0x2e4]
push eax
push ecx
push esi
push 0x1e
push edi
call fcn.004b9450
add esp, 0x24
cmp eax, 0x5030
jne 0x4d8747
mov eax, dword [esp + 0x2d4]
dec eax
cmp eax, 5
ja case.0x4d86e4.3
jmp dword [eax*4 + 0x4d8774]
mov dx, word [esp + 0x31c]
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
mov word [esp + 0x14], dx
mov dword [esp + 0x10], eax
call fcn.004d7fe0
jmp 0x4d8747
mov edx, dword [0x59cfc4]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4d8741
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4d8741
mov eax, dword [0x59cfc4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0xdc
push edi
call fcn.004b99e0
add esp, 4
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x5304]
pop edi
pop esi
pop ebx
xor ecx, esp
sar eax, 3
call fcn.00526a8a
add esp, 0x52fc
ret 0xc
Function at 0x4d9840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x94
push 0xffffffffffffffff
push 0x546190
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x463df0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x9c]
mov ebx, dword [ebp + 0xa0]
xor eax, eax
push 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0x20
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call fcn.004d3ec0
cmp eax, 0x10
jne 0x4d9942
cmp word [ebp - 0x28], 0
je 0x4d9942
push 0x90
lea ecx, [ebp]
push 0
push ecx
mov dword [ebp - 4], 0
call fcn.00526600
add esp, 0xc
push 0x90
lea edx, [ebp]
push edx
push 1
push edi
mov ecx, esi
call fcn.004d3ec0
cmp eax, 0x90
je 0x4d992a
mov eax, dword [0x59cfc4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d992a
cmp dword [eax], 0x73
jne 0x4d992a
mov ecx, dword [ebp + 0xa4]
push 0
push 0
push ecx
push ebx
push 0x15
push edi
mov ecx, esi
call fcn.004d8c30
test eax, eax
je 0x4d992a
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
jmp 0x4d997a
mov edx, dword [0x59cfc4]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4d9972
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4d9972
mov eax, dword [0x59cfc4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.00526a8a
add ebp, 0x94
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4da340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
mov eax, dword [0x59cfc4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebp
push esi
push edi
push eax
mov edi, ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4da37b
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x4da37b
mov ecx, dword [0x59cfc4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 4
lea edx, [esp + 0x1c]
push edx
mov dword [esi], 0
call fcn.004ee390
test al, al
jne 0x4da3c9
mov eax, dword [0x59cfc4]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4da3b9
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x4da3b9
mov ecx, dword [0x59cfc4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x72
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
cmp dword [esp + 0x18], 0xffff
jbe 0x4da3f7
mov edx, dword [0x59cfc4]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x4da3b9
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x4da3b9
mov eax, dword [0x59cfc4]
push esi
push eax
jmp 0x4da3b3
mov eax, dword [esp + 0x24]
add eax, eax
add eax, eax
je 0x4da448
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.004ee390
test al, al
jne 0x4da448
mov edx, dword [0x59cfc4]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x4da438
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x4da438
mov eax, dword [0x59cfc4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x71
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
test ebp, ebp
jne 0x4da4b4
test ebx, ebx
je 0x4da4b8
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x10
push edx
mov ecx, edi
mov dword [esi], 0
mov dword [esp + 0x20], 0
call fcn.004d3ec0
cmp eax, 4
jne 0x4da3bf
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push esi
push ebx
and eax, 8
push ecx
push ebp
cmp al, 8
jne 0x4da4cb
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
mov ecx, edi
call fcn.004d9580
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20
test ebx, ebx
je 0x4da458
push 0x69
mov ecx, edi
call fcn.004cc3d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.004d9a80
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20
Function at 0x4db0c0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.004dae20
mov ecx, dword [esi + 0x18]
cmp ecx, 0xffffffff
je 0x4db0fa
push 0
push 0
push 0
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x4db0f5
xor al, al
pop esi
ret 8
mov dword [esi + 0x14], eax
mov al, 1
pop esi
ret 8
Function at 0x4dc8a0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x5c], eax
ret
Function at 0x4dcc00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
movzx eax, word [esi]
test ecx, ecx
je 0x4dcc36
push edi
movzx edi, byte [edx]
xor edi, eax
shr ax, 8
and edi, 0xff
xor ax, word [edi*2 + 0x461fa0]
dec ecx
inc edx
movzx eax, ax
test ecx, ecx
jne 0x4dcc15
pop edi
mov word [esi], ax
pop esi
ret 0xc
Function at 0x4e02a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [eax + 4]
push esi
mov esi, ecx
mov eax, dword [esi]
cdq
sub eax, edx
sar eax, 1
push edi
add eax, 4
xor ecx, ecx
xor edi, edi
test eax, eax
jle 0x4e02f8
mov eax, ebp
xor eax, ecx
push eax
push ebx
mov ecx, esi
call fcn.004e0200
mov edx, dword [esi + 8]
movzx ecx, ax
mov dword [edx + edi*8], ecx
mov edx, dword [esi + 8]
mov ecx, eax
shr ecx, 0x10
mov dword [edx + edi*8 + 4], ecx
mov ecx, ebx
mov ebx, ebp
mov ebp, eax
mov eax, dword [esi]
cdq
sub eax, edx
sar eax, 1
inc edi
add eax, 4
cmp edi, eax
jl 0x4e02c1
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4e0300
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebp, ecx
mov ebx, dword [ebp]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + ebx*4]
movzx esi, word [eax + ebx*4 + 0xc]
movzx edx, word [eax + ebx*4 + 8]
push edi
movzx edi, word [eax + ebx*4 + 4]
shl edi, 0x10
shl esi, 0x10
or edi, ecx
mov ecx, dword [esp + 0x1c]
xor edi, dword [ecx]
or esi, edx
xor esi, dword [ecx + 4]
xor esi, edi
test ebx, ebx
jle 0x4e0368
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edx
push esi
mov ecx, ebp
call fcn.004e0180
add dword [esp + 0x10], 4
xor eax, edi
sub dword [esp + 0x14], 1
mov edi, esi
mov esi, eax
jne 0x4e0343
mov ecx, dword [esp + 0x1c]
mov ebp, dword [ebp + 8]
movzx eax, word [ebp + ebx*4 + 0x1c]
movzx edx, word [ebp + ebx*4 + 0x18]
shl eax, 0x10
or eax, edx
movzx edx, word [ebp + ebx*4 + 0x10]
xor edi, esi
xor edi, eax
movzx eax, word [ebp + ebx*4 + 0x14]
shl eax, 0x10
or eax, edx
mov dword [ecx + 4], edi
pop edi
xor eax, esi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
add esp, 8
ret 4

Function at 0x4e04a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, eax
and eax, 7
mov ebp, ecx
shr edi, 3
mov ecx, eax
mov dword [esp + 0x1c], ecx
test edi, edi
jbe 0x4e04e4
mov eax, dword [ebx]
xor dword [esi], eax
mov ecx, dword [ebx + 4]
xor dword [esi + 4], ecx
push esi
mov ecx, ebp
call fcn.004e0300
mov ebx, esi
dec edi
add esi, 8
test edi, edi
ja 0x4e04c4
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4e0508
mov eax, ebx
jbe 0x4e0500
sub esi, ebx
mov edi, ecx
mov dl, byte [eax]
mov cl, byte [esi + eax]
mov byte [esi + eax], dl
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x4e04f0
push ebx
mov ecx, ebp
call fcn.004e0300
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov edx, dword [ebx + 4]
pop ebp
mov dword [eax + 4], edx
pop ebx
ret 0xc
Function at 0x4e8d00
Capabilities:
Check os version

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push 0x9c
lea edi, [esi + 0x78]
push 0
push edi
call fcn.00526600
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
push edi
mov dword [edi], 0x9c
call ebx
test eax, eax
jne 0x4e8d44
push edi
mov dword [edi], 0x94
call ebx
test eax, eax
jne 0x4e8d44
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov edx, 0x5f03
shr ecx, 0x10
cmp ax, dx
jne 0x4e8d7a
cmp ecx, 0x800
jb 0x4e8d68
mov eax, 0x5a04
jmp 0x4e8d7a
cmp ecx, 0x70a
sbb eax, eax
and eax, 0xfffff600
add eax, 0xa04
movzx ecx, al
mov edx, eax
shr edx, 8
mov dword [esi + 0x114], ecx
movzx ecx, dl
movzx edx, byte [esi + 0x114]
mov dword [esi + 0x118], ecx
shl dx, 8
movzx cx, cl
or dx, cx
shr eax, 0x1f
mov word [esi + 0x11c], dx
movzx edx, word [esi + 0x10c]
not al
mov bl, 1
and al, bl
cmp byte [esi + 0x112], 3
mov byte [esi + 0x120], al
mov word [esi + 0x11e], dx
jne 0x4e8dd6
mov byte [esi + 0x121], bl
cmp dword [esi + 0x88], 2
jne 0x4e8e02
mov al, byte [esi + 0x110]
shr al, 4
test bl, al
je 0x4e8e02
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne cl
mov byte [esi + 0x124], cl
cmp byte [esi + 0x120], 0
je 0x4e8e87
xor edx, edx
push 0x46d668
mov word [esp + 0x10], dx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4e8e41
push 0x46d654
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e8e3a
lea ecx, [esp + 0xc]
push ecx
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, word [esp + 0xc]
cmp ax, 6
je 0x4e8e52
cmp ax, 9
jne 0x4e8e58
mov byte [esi + 0x122], bl
cmp byte [esi + 0x121], 0
jne 0x4e8e87
cmp dword [esi + 0x114], 5
jne 0x4e8e87
cmp dword [esi + 0x118], 2
jne 0x4e8e87
cmp byte [esi + 0x112], bl
jne 0x4e8e81
cmp ax, 9
je 0x4e8e87
mov byte [esi + 0x121], bl
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x24
ret

Function at 0x4e9010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5474b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 1
call fcn.004c4af0
lea ecx, [esi + 4]
mov byte [esp + 0x14], 0
call fcn.004e8fb0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004fc270
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4e9150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5474ee
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004fc1b0
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x18], ebx
call fcn.004d7e60
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.004e8f00
xor eax, eax
mov dword [esi + 0x74], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov byte [esi + 0x120], bl
mov byte [esi + 0x121], bl
mov byte [esi + 0x122], bl
mov byte [esi + 0x123], bl
mov byte [esi + 0x124], bl
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov ecx, esi
mov byte [esp + 0x18], 2
mov dword [esi + 0x2c], eax
call fcn.004fc180
mov eax, esi
cmp dword [0x59df5c], ebx
jne 0x4e91f3
mov dword [0x59df5c], esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4ead80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esp + 0x10], 0
mov byte [esp + 7], 1
jle 0x4eaddc
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push edi
lea esp, [esp]
movzx eax, byte [esp + 0x13]
mov dl, byte [eax + esi]
add eax, esi
add cl, dl
inc byte [esp + 0x13]
movzx edi, cl
mov bl, byte [edi + esi]
add edi, esi
mov byte [eax], bl
mov byte [edi], dl
movzx eax, byte [eax]
add al, dl
movzx edx, al
movzx eax, byte [edx + esi]
xor byte [ebp], al
mov eax, dword [esp + 0x1c]
dec eax
inc ebp
mov dword [esp + 0x1c], eax
test eax, eax
jg 0x4eada0
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 8

Function at 0x4ee460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x547d78
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
xor ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi], 0x46d870
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x18], ebx
call fcn.004db130
mov byte [esi + 0x34], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x40], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret