joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455a10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x455b81
sub esp, 0x14
lea eax, [0x52ff14]
mov dword [esp], eax
call fcn.00474880
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x455a47
mov ecx, dword [esp + 0x18]
jmp 0x455a62
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x455a62
lea eax, [ecx + 0x30]
mov dword [esp], eax
call fcn.0040ad70
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.004554c0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x4a09f0]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call fcn.00455480
mov eax, dword [esp + 0x10]
test eax, eax
je 0x455aa0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00455900
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x455ae0
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x455ae0
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004748f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
test eax, eax
jne 0x455b1e
movzx edx, byte [ecx + 6]
test dl, dl
je 0x455b1e
inc dword [ecx + 0x28]
mov dword [esp], ecx
call fcn.00455510
mov eax, dword [esp + 0x10]
test eax, eax
je 0x455b35
movzx ebp, byte [esp + 0xf]
jmp 0x455b77
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x455b48
movzx ebp, byte [esp + 0xf]
jmp 0x455b77
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.0040af90
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00455570
mov eax, dword [esp + 4]
mov dword [esp], eax
call fcn.00405e70
movzx ebp, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
add esp, 0x14
ret
call fcn.0046eed0
jmp fcn.00455a10
Function at 0x4578e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4579c7
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.004554c0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x4a2279]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call fcn.00455480
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45793d
call fcn.00457740
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x457991
test cl, 4
je 0x457991
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x457991
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.004748f0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00456010
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.00455510
movzx eax, byte [esp + 0xf]
test al, al
je 0x4579c3
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.004560d0
add esp, 0x14
ret
call fcn.0046eed0
jmp fcn.004578e0

Function at 0x45dd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ddd9
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x45dd56
mov ecx, 1
jmp 0x45dd74
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0045ce50
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x45dd8a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x45ddb7
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call fcn.0045ca10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call fcn.0046eed0
jmp fcn.0045dd30
Function at 0x45f350
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45f532
sub esp, 0x54
mov eax, dword [0x52fb9c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call fcn.0045d690
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call fcn.00461970
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.0045d940
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call fcn.0044c330
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x45f491
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x45f51e
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044c330
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
lea ecx, [0x511090]
add eax, ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.0045d940
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0045d9c0
add esp, 0x54
ret
call fcn.0046eed0
jmp fcn.0045f350
Function at 0x4611f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4613f8
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x4613a8
mov ecx, dword [esp + 0x90]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x8c]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and edx, ebp
test dl, dl
je 0x4612b8
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045da00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x46133a
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.0045da00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x46138f
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.0045da00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043a8c0
lea eax, [0x4a22a3]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043b0d0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043adf0
call fcn.0043aaa0
call fcn.0043a920
lea eax, [0x4a844d]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0046b0d0
nop
call fcn.0046eed0
jmp fcn.004611f0
Function at 0x46e160
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46e1fb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x52fb9c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004703b7
lea ecx, [0x45b6e0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0046ede0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0046eed0
jmp fcn.0046e160
Function at 0x470180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x52fdc0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46e90b
je 0x46e95e
cmp ebx, 0x20
jbe 0x46e964
cmp ebx, 0x40
jbe 0x46e9aa
jmp 0x46ea4b
test ebx, ebx
je 0x46e954
add eax, 0x10
test ax, 0xff0
je 0x46e940
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4ae740]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4ae840]
jmp 0x46e928
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46e928
pxor xmm1, xmmword [0x52fdd0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x52fdd0]
pxor xmm2, xmmword [0x52fde0]
pxor xmm3, xmmword [0x52fdf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x52fdd0]
pxor xmm2, xmmword [0x52fde0]
pxor xmm3, xmmword [0x52fdf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46eaaa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x52fa87], 0
je 0x47019a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46e8d0
jmp fcn.004090d0
Function at 0x4701a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403d7c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004090d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0046eed0
jmp 0x403d40
cmp byte [0x52fa87], 0
je 0x4701bb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x46e8d0
jmp 0x403d40

Function at 0x470f10
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x470f2a
mov ecx, 0x14
jmp 0x470f33
shl ecx, 2
add ecx, 0xe10
mov dword [0x52fb9c], ecx
ret
Function at 0x47b3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b46e
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor eax, eax
jmp 0x47b45d
mov dword [esp + 4], edx
mov esi, ebx
and esi, 0xff
xor ecx, esi
shr ebx, 8
mov esi, ebp
shl esi, 0x18
mov dword [esp], esi
mov edi, eax
mov eax, ecx
mov esi, 0x1b3
mul esi
shl ecx, 8
mov esi, dword [esp + 4]
imul esi, esi, 0x1b3
add esi, edx
inc edi
mov edx, edi
mov edi, dword [esp]
or ebx, edi
shr ebp, 8
add esi, ecx
mov ecx, eax
mov eax, edx
mov edx, esi
cmp eax, 8
jl 0x47b417
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
add esp, 8
ret
call fcn.0046eed0
jmp fcn.0047b3f0

Function at 0x47b480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b4db
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor eax, eax
jmp 0x47b4cd
mov ebp, ebx
and ebp, 0xff
xor ecx, ebp
mov ebp, eax
mov eax, ecx
mov esi, 0x1b3
mov edi, edx
mul esi
shl ecx, 8
imul edi, edi, 0x1b3
add edi, edx
inc ebp
shr ebx, 8
lea edx, [ecx + edi]
mov ecx, eax
mov eax, ebp
cmp eax, 4
jl 0x47b4a0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ret
call fcn.0046eed0
jmp fcn.0047b480
Function at 0x4878c0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x52fb9c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48790c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.0046eed0
jmp fcn.004878c0
Function at 0x10241b1e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10280a90], 0
mov byte [0x10280a94], 0
mov dword [0x10280a88], 0x247e
mov dword [0x10280a8c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10241b88
xor eax, eax
mov dword [0x10280a8c], 0
mov dword [ebp - 0x20], eax
jmp 0x10241bb0
mov dword [0x10280a84], 0x71f
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10280a8c]
add eax, 1
mov dword [0x10280a8c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10241b88
jmp 0x10241b65
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10280a98], 0
mov edi, dword [0x10280a84]
mov ebx, edi
add ebx, 0xffffd965
mov dword [0x10280a88], ebx
mov ebx, dword [0x10280a90]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x10280a98], ecx
mov dword [0x10280a88], 0x162a
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x10280a90], edx
add edi, 0x26f4
mov dword [0x10280a84], edi
mov edi, dword [ebp - 0x24]
mov cl, byte [esi + edi]
mov byte [0x10280a94], cl
mov dword [0x10280a84], 0x8fc
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov dword [0x10280a84], 0x721
mov cl, byte [0x10280a94]
mov edx, dword [0x10280a90]
mov byte [esi + edx], cl
mov dword [0x10280a88], 0x15d4
mov edx, dword [0x10280a8c]
add edx, 1
mov dword [0x10280a8c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10241bb0
jmp 0x10241b76
Function at 0x102422a9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x102456b3]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x10280a84]
add ebx, 0x1e99
mov dword [0x10280a84], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.10241f72
mov eax, dword [0x10280a84]
add eax, 0xfffffc44
mov dword [0x10280a88], eax
mov dword [0x10280a84], 0x6c2
call fcn.10241eba
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.102420f4
mov dword [0x10280a84], 0x236d
cmp eax, 0
sete cl
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], cl
xor eax, eax
mov cl, byte [ebp - 0x41]
test cl, 1
mov dword [ebp - 0x48], eax
jne 0x10242404
jmp 0x10242350
mov dword [0x10280a84], 0x1258
mov eax, dword [ebp - 0x40]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x10280a84]
add ecx, 0x194b
mov dword [0x10280a88], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x4c], eax
call fcn.1024189d
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x24], ecx
mov dword [0x10280a84], 0x341
mov ecx, dword [ebp - 0x4c]
mov dword [edx + 0x48], ecx
cmp ecx, 0
mov dword [ebp - 0x48], eax
je 0x10242404
mov eax, dword [ebp - 0x4c]
add eax, 0x2673
mov dword [0x10280a88], 0x1ddf
mov dword [0x10280a84], 0xffffefc9
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1024240f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [0x10280a84], 0x1367
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x10280a84]
mov edi, esi
add edi, 0xffffec0a
mov dword [0x10280a84], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x10242489
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
jl 0x1024245c
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
add edx, 0xfffff5a8
mov dword [0x10280a84], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jne 0x10242585
xor eax, eax
mov dword [0x10280a84], 0x28f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x2c], eax
jne 0x10242585
mov dword [0x10280a84], 0x2505
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x2c], eax
jne 0x10242585
xor eax, eax
mov dword [0x10280a88], 0x870
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x2c], eax
jne 0x10242585
xor eax, eax
mov dword [0x10280a84], 0x264f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x2c], eax
jne 0x10242585
mov dword [0x10280a84], 0x1f9e
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x30], ecx
xor eax, eax
mov ecx, dword [ebp - 0x30]
cmp word [ecx], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x10242585
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x10242585
mov eax, 1
mov dword [0x10280a84], 0x536
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add esp, 0x28
pop esi
pop edi
pop ebp
ret