joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459ee0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a051
sub esp, 0x14
lea eax, [0x8c8c34]
mov dword [esp], eax
call fcn.0047bef0
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x459f17
mov ecx, dword [esp + 0x18]
jmp 0x459f32
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x459f32
lea eax, [ecx + 0x30]
mov dword [esp], eax
call fcn.0040c130
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.00459990
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x702628]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call fcn.00459950
mov eax, dword [esp + 0x10]
test eax, eax
je 0x459f70
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00459dd0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x459fb0
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x459fb0
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0047bf60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
test eax, eax
jne 0x459fee
movzx edx, byte [ecx + 6]
test dl, dl
je 0x459fee
inc dword [ecx + 0x28]
mov dword [esp], ecx
call fcn.004599e0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45a005
movzx ebp, byte [esp + 0xf]
jmp 0x45a047
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45a018
movzx ebp, byte [esp + 0xf]
jmp 0x45a047
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.0040c350
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00459a40
mov eax, dword [esp + 4]
mov dword [esp], eax
call fcn.00406eb0
movzx ebp, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
add esp, 0x14
ret
call fcn.00475ee0
jmp fcn.00459ee0
Function at 0x45bdb0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45be97
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.00459990
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x705583]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call fcn.00459950
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45be0d
call fcn.0045bc10
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x45be61
test cl, 4
je 0x45be61
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x45be61
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.0047bf60
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045a4e0
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004599e0
movzx eax, byte [esp + 0xf]
test al, al
je 0x45be93
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045a5a0
add esp, 0x14
ret
call fcn.00475ee0
jmp fcn.0045bdb0

Function at 0x462200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4622a9
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x462226
mov ecx, 1
jmp 0x462244
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.00461320
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x46225a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x462287
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call fcn.00460ee0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call fcn.00475ee0
jmp fcn.00462200
Function at 0x463820
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463a02
sub esp, 0x54
mov eax, dword [0x8c8600]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call fcn.00461b60
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call fcn.00465e40
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.00461e10
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call fcn.0044ee50
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x463961
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x4639ee
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044ee50
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
lea ecx, [0x8a9290]
add eax, ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461e10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00461e90
add esp, 0x54
ret
call fcn.00475ee0
jmp fcn.00463820
Function at 0x4656c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4658c8
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x465878
mov ecx, dword [esp + 0x90]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x8c]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and edx, ebp
test dl, dl
je 0x465788
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.00461ed0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x46580a
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.00461ed0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x46585f
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461ed0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043d340
lea eax, [0x7055ad]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043db50
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043d870
call fcn.0043d520
call fcn.0043d3a0
lea eax, [0x715ae3]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00470dd0
nop
call fcn.00475ee0
jmp fcn.004656c0
Function at 0x475170
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47520b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x8c8600]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004773d7
lea ecx, [0x45fbb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00475df0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00475ee0
jmp fcn.00475170
Function at 0x477190
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x8c8ae0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x47591b
je 0x47596e
cmp ebx, 0x20
jbe 0x475974
cmp ebx, 0x40
jbe 0x4759ba
jmp 0x475a5b
test ebx, ebx
je 0x475964
add eax, 0x10
test ax, 0xff0
je 0x475950
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x736cc0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x736dc0]
jmp 0x475938
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x475938
pxor xmm1, xmmword [0x8c8af0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8c8af0]
pxor xmm2, xmmword [0x8c8b00]
pxor xmm3, xmmword [0x8c8b10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8c8af0]
pxor xmm2, xmmword [0x8c8b00]
pxor xmm3, xmmword [0x8c8b10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x475aba
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x8c84ac], 0
je 0x4771aa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4758e0
jmp fcn.0040a370
Function at 0x4771b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x404dbc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0040a370
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00475ee0
jmp 0x404d80
cmp byte [0x8c84ac], 0
je 0x4771cb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4758e0
jmp 0x404d80

Function at 0x477f30
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x477f4a
mov ecx, 0x14
jmp 0x477f53
shl ecx, 2
add ecx, 0xe10
mov dword [0x8c8600], ecx
ret
Function at 0x4941b0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4941e6
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x4941dd
movzx ebp, byte [eax + ebx]
imul edx, edx, 0x1000193
inc ebx
xor edx, ebp
cmp ecx, ebx
jg 0x4941d0
mov dword [esp + 0x14], edx
ret
call fcn.00475ee0
jmp fcn.004941b0
Function at 0x4a41f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a426e
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor eax, eax
jmp 0x4a425d
mov dword [esp + 4], edx
mov esi, ebx
and esi, 0xff
xor ecx, esi
shr ebx, 8
mov esi, ebp
shl esi, 0x18
mov dword [esp], esi
mov edi, eax
mov eax, ecx
mov esi, 0x1b3
mul esi
shl ecx, 8
mov esi, dword [esp + 4]
imul esi, esi, 0x1b3
add esi, edx
inc edi
mov edx, edi
mov edi, dword [esp]
or ebx, edi
shr ebp, 8
add esi, ecx
mov ecx, eax
mov eax, edx
mov edx, esi
cmp eax, 8
jl 0x4a4217
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
add esp, 8
ret
call fcn.00475ee0
jmp fcn.004a41f0

Function at 0x4a4280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a42db
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor eax, eax
jmp 0x4a42cd
mov ebp, ebx
and ebp, 0xff
xor ecx, ebp
mov ebp, eax
mov eax, ecx
mov esi, 0x1b3
mov edi, edx
mul esi
shl ecx, 8
imul edi, edi, 0x1b3
add edi, edx
inc ebp
shr ebx, 8
lea edx, [ecx + edi]
mov ecx, eax
mov eax, ebp
cmp eax, 4
jl 0x4a42a0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ret
call fcn.00475ee0
jmp fcn.004a4280
Function at 0x4b2b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b2cdb
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.004773db
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x4b2b7f
xor edx, edx
jmp 0x4b2baa
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x70b729]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.004040c0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x4b2bb5
mov edx, 1
jmp 0x4b2be9
cmp ecx, 0x23
je 0x4b2bbe
xor edx, edx
jmp 0x4b2be9
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x710b94]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.004040c0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x4b2c43
lea edi, [esp + 0x3c]
call fcn.004773db
mov ecx, dword [0x8a1458]
lea edx, [0x734f60]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.004bcb00
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.004778be
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x4b2cba
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.004773db
mov ecx, dword [0x8a1454]
mov edx, dword [0x8a1458]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.004b2cf0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.004778be
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004778be
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004778be
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.00475ee0
jmp fcn.004b2b50
Function at 0x4b6cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b6e88
sub esp, 0x60
mov eax, dword [esp + 0x68]
and eax, dword [esp + 0x7c]
test eax, 0x80000000
jne 0x4b6e44
lea eax, [esp + 0x64]
mov dword [esp], eax
call fcn.004b5850
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x78]
mov dword [esp], edx
call fcn.004b5850
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x3c], ecx
lea edx, [esp + 0x64]
mov dword [esp], edx
call fcn.004b5820
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x78]
mov dword [esp], ecx
call fcn.004b5820
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 4]
lea edi, [esp]
lea esi, [esp + 0x78]
call fcn.004778be
mov ecx, eax
sar eax, 0x1f
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
sub edx, ebx
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x3c]
sbb ebx, ebp
mov ebp, eax
mov eax, edx
mov esi, 0x3b9aca00
mul esi
imul ebx, ebx, 0x3b9aca00
add edx, ebx
add eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
adc edx, ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], edx
call fcn.004b6af0
lea edi, [esp + 0x4c]
lea esi, [esp + 0x1c]
call fcn.004778be
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.004778be
lea edi, [esp + 0x14]
lea esi, [esp + 0x64]
call fcn.004778be
call fcn.004b5d10
movzx eax, byte [esp + 0x28]
test al, al
jne 0x4b6e2a
lea edi, [esp]
lea esi, [esp + 0x64]
call fcn.004778be
lea edi, [esp + 0x14]
lea esi, [esp + 0x78]
call fcn.004778be
call fcn.004b5c10
movzx eax, byte [esp + 0x28]
test al, al
je 0x4b6e10
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0x80000000
add esp, 0x60
ret
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x90], 0x7fffffff
add esp, 0x60
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x90], eax
add esp, 0x60
ret
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004b6ea0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x60
ret
call fcn.00475ee0
jmp fcn.004b6cc0
Function at 0x4bddc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bdeca
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4bddf6
lea eax, [0x7320bc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
dec eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4bde02
xor ecx, ecx
jmp 0x4bde1e
mov ecx, dword [esp + 0x20]
movzx edx, byte [eax + ecx - 1]
mov byte [esp], dl
call fcn.004bdf40
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, dword [esp + 0x14]
test cl, cl
jne 0x4bddf5
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004bdee0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x14], ecx
mov edx, ecx
neg ecx
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x18], eax
lea ecx, [edx - 1]
jmp 0x4bde59
dec ecx
test ecx, ecx
jge 0x4bde61
xor ebx, ebx
jmp 0x4bde87
mov dword [esp + 0x10], ecx
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.004bdf40
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x18]
test bl, bl
jne 0x4bde58
test ecx, ecx
jl 0x4bdea2
sub edx, ecx
dec edx
mov ebx, edx
neg edx
sar edx, 0x1f
lea ebp, [ecx + 1]
and edx, ebp
add eax, edx
jmp 0x4bdea4
mov ebx, edx
test ebx, ebx
jne 0x4bdebe
lea eax, [0x732208]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
add esp, 0x1c
ret
call fcn.00475ee0
jmp fcn.004bddc0