joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b440
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe6000]
push edi
or ebp, 0xffffffff
jmp 0x53b462
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53b469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b458
mov eax, 1
add ebx, ebx
jne 0x53b47b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53b48c
jne 0x53b4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b4ab
dec eax
add ebx, ebx
jne 0x53b498
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53b470
add ebx, ebx
jne 0x53b4a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53b4fd
xor ecx, ecx
sub eax, 3
jb 0x53b4c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53b532
sar eax, 1
mov ebp, eax
jmp 0x53b4ce
add ebx, ebx
jne 0x53b4ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b49c
inc ecx
add ebx, ebx
jne 0x53b4dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b49c
add ebx, ebx
jne 0x53b4e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53b4de
jne 0x53b4fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53b4de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53b51c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53b50e
jmp 0x53b45e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53b51c
add edi, ecx
jmp 0x53b45e
pop esi
mov edi, esi
mov ecx, 0x3c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53b53a
cmp byte [edi], 9
jne 0x53b53a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53b53f
lea edi, [esi + 0x139000]
mov eax, dword [edi]
or eax, eax
je 0x53b5b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13fbb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13fbf0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53b56c
mov ecx, edi
jns 0x53b59b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13fbf4]
or eax, eax
je 0x53b5b1
mov dword [ebx], eax
add ebx, 4
jmp 0x53b589
call dword [esi + 0x13fc04]
mov ebp, dword [esi + 0x13fbf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53b5eb
sub esp, 0xffffff80
jmp 0x40133c
Function at 0x4025d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00402c20
call fcn.004028c0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x402608
jmp 0x4026a6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x402607
cmp cl, 0x22
je 0x402660
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x402680
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x402680
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x402640
jmp 0x402680
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x402660
cmp cl, 0x22
je 0x4026e2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4026a0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x402690
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4026c4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004024d4
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x402680
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x79d67c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d682
pop ebp
sub ebp, 6
sub ebp, 0x39d67c
jmp 0x79d6e0
jmp 0x79d6e9
mov eax, 0x39d67c
add eax, ebp
add eax, 0x93
mov ecx, 0x640
mov edx, 0x25ef80a5
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d700
jmp 0x79d713
iretd
Function at 0x4027b1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4027f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4027f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4027f0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4027f0
cmp dword [ecx + 0x74], 0xe
jbe 0x4027f0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40153f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40162d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040153f
test eax, eax
jne 0x4016c7
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40215e
sub eax, 0x4016fc
mov dword [esp], 0x4016fc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c7
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401442
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014c9
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401e61
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x5fb830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19e000]
push edi
jmp 0x5fb84a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fb851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fb840
mov eax, 1
add ebx, ebx
jne 0x5fb863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fb874
jne 0x5fb893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fb893
dec eax
add ebx, ebx
jne 0x5fb880
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fb858
add ebx, ebx
jne 0x5fb88f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5fb8e5
xor ecx, ecx
sub eax, 3
jb 0x5fb8ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fb91a
sar eax, 1
mov ebp, eax
jmp 0x5fb8b6
add ebx, ebx
jne 0x5fb8b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fb884
inc ecx
add ebx, ebx
jne 0x5fb8c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fb884
add ebx, ebx
jne 0x5fb8d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fb8c6
jne 0x5fb8e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fb8c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fb904
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fb8f6
jmp 0x5fb846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fb904
add edi, ecx
jmp 0x5fb846
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fb922
cmp byte [edi], 0x11
jne 0x5fb922
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5fb927
lea edi, [esi + 0x1f4000]
mov eax, dword [edi]
or eax, eax
je 0x5fb99f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x310fd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x311150]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fb954
mov ecx, edi
jns 0x5fb983
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x311154]
or eax, eax
je 0x5fb999
mov dword [ebx], eax
add ebx, 4
jmp 0x5fb971
call dword [esi + 0x311164]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5fb9d0
cmp al, 0xef
ja 0x5fb9c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5fb9a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5fb9b2
mov ebp, dword [esi + 0x311158]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5fba04
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x471b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0x471ba0
push 0x5af528
call fcn.00471cb0
mov eax, dword [0x5af510]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x471b95
mov ecx, dword [0x5b2cd8]
mov edx, dword fs:[0x2c]
push ebx
push esi
mov ebx, dword [edx + ecx*4]
push edi
add ebx, 8
mov ecx, 0xb
mov esi, 0x58f6f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x5af510]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
pop edi
pop esi
xor eax, eax
mov dword [ecx], ebx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop ebp
ret
Function at 0x486ff0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x5b2c58]
push ebx
xor eax, eax
push esi
test edx, edx
push edi
jbe 0x487018
mov ecx, 0x5afc58
mov esi, dword [ebp + 8]
mov edi, dword [ecx]
cmp esi, edi
je 0x487035
inc eax
add ecx, 8
cmp eax, edx
jb 0x487007
mov eax, dword [ebp + 0xc]
push 0x800
push 0x5b20ec
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x487041
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [eax*8 + 0x5afc5c]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 0x10000080
push 3
push 0
push 1
push 0x80000000
push 0x5b20ec
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x487072
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
jne 0x48709f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
jne 0x4870c9
call ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov eax, dword [edx + 0x18]
add eax, ecx
mov ecx, dword [0x5b2c58]
mov dword [ecx*8 + 0x5afc58], edx
mov dword [ecx*8 + 0x5afc5c], eax
inc ecx
mov dword [0x5b2c58], ecx
pop ebp
ret
Function at 0x487d40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi + 0xc]
add eax, edx
cmp byte [eax], 0xcc
jne 0x487d68
mov edx, dword [esi + 8]
cmp ecx, edx
jae 0x487d68
mov bl, byte [eax + 1]
inc eax
inc ecx
cmp bl, 0xcc
je 0x487d5a
mov edx, dword [esi + 8]
pop esi
cmp ecx, edx
pop ebx
jb 0x487d75
xor eax, eax
pop ebp
ret
mov dl, byte [eax]
xor ecx, ecx
cmp dl, 0xe9
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x489440
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x209
mov esi, dword [ebp + 0xc]
lea eax, [edi + 5]
cdq
idiv ecx
lea eax, [edx + 0x69]
mov dword [esi], eax
mov ecx, dword [0x58f71c]
cmp ecx, 2
lea ecx, [eax*8]
jl 0x489527
sub ecx, eax
shl ecx, 2
mov eax, dword [ecx + 0x630260]
test eax, eax
jne 0x4894ef
lea edx, [ecx + 0x630264]
push edx
call fcn.00471c40
add esp, 4
test eax, eax
jne 0x489541
mov ecx, dword [esi]
lea eax, [ecx*8]
sub eax, ecx
shl eax, 2
mov ecx, dword [eax + 0x630260]
test ecx, ecx
jne 0x4894e5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*8]
sub edx, ecx
mov dword [edx*4 + 0x630260], eax
mov eax, dword [esi]
lea ecx, [eax*8]
sub ecx, eax
mov dword [ecx*4 + 0x630264], 0
jmp 0x4894ef
mov dword [eax + 0x630264], 0
mov eax, dword [esi]
push 0xffffffffffffffff
lea edx, [eax*8]
sub edx, eax
mov eax, dword [edx*4 + 0x630260]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi]
lea ecx, [eax*8]
sub ecx, eax
lea edx, [ecx*4 + 0x630264]
push edx
call fcn.00471c40
add esp, 4
jmp 0x489541
sub ecx, eax
lea eax, [ecx*4 + 0x630264]
mov ecx, dword [ecx*4 + 0x630264]
test ecx, ecx
jne 0x489541
mov dword [eax], 1
cmp dword [0x58f71c], 1
jl 0x489565
mov eax, dword [esi]
lea edx, [eax*8]
sub edx, eax
lea eax, [edx*4 + 0x630270]
push eax
call fcn.00471be0
add esp, 4
mov esi, dword [esi]
mov eax, dword [ebp + 0x10]
lea ecx, [esi*8]
sub ecx, esi
mov edx, dword [ecx*4 + 0x630278]
mov dword [eax], edx
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov ecx, dword [eax]
test ecx, ecx
je 0x4895a2
mov ecx, dword [eax]
cmp dword [ecx + 0xb8], edi
jge 0x4895a2
mov dword [edx], ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x18]
test ecx, ecx
mov dword [eax], ecx
jne 0x48958b
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x48a6e0
Capabilities:
Encode data using xor

Disassembly:
ror dword [0x9c37ec56], cl
daa
out 0x9b, al
jecxz 0x48a6f1
xor sp, word [esi - 0x330c70c3]
xor esp, dword [esi - 0x330c70c3]
imul esi, dword [0xc6c6c9c7], 0x1b
xchg dword [ecx + 0x6b], ebp
les esi, [edi + edx*2]
lds esi, [edi - 0x8b3b443]
pushfd
out 0x4b, al
out dx, al
adc al, 0xd7
jo 0x48a68a
int3
xchg edi, eax
invalid
xor eax, dword [esi]
jno 0x48a67f
and esi, ecx
mov edi, 0x301ed311
bound ebx, qword [edx + 0x332e26e2]
out dx, al
pop edx
rcr dword [eax], cl
test dword [ecx + 0x155f0e6c], ebx
push 0x570a4e9c
inc edx
cmpsd dword [esi], dword es:[edi]
bound edi, qword gs:[esi + esi + 0x5ee39a4b]
push edx
idiv byte [ebp + 0x698dd68f]
adc bl, dl
jns 0x48a6dc
into
xor al, 0xf7
jno 0x48a794
loop 0x48a731
inc edi
invalid
cmpsd dword [esi], dword es:[edi]
invalid
stc
ret 0x3dda

Function at 0x48bb40
Capabilities:
Encode data using xor

Disassembly:
int3
test byte [ecx - 0x72], ch
pop ss
out 0x3a, al
in eax, dx
mov dh, bl
mov dword [0x2d8c398a], eax
mov dl, bl
mov al, byte [0xcc46987]
fisttp dword [ebx + 0x15931fa5]
insb byte es:[edi], dx
jae 0x48bab8
and eax, 0x4934f39b
mov bl, 0xfe
invalid
jge 0x48badc
xor bl, ch
test dword [ecx + 0x4c], edi
adc esp, dword [edi + 0x491c5319]
or edx, dword [edi + 0xc]
mov dword [0x841dc33d], eax
cmp dword [esi + 0x33], ecx
pop eax
dec edx
xor ebp, eax
lodsb al, byte [esi]
imul edi, dword [esi - 0x3b81012d], 0xa3064e18
cmp dword [ebp - 0x490c7197], ecx
cmp dword [ebx - 0x3a], 0xffffff8e
ror dword [ecx - 0x3cfe5395], cl
sahf
outsd dx, dword [esi]
jl 0x48bbee
cwde
imul ebx, dword [edx - 0x68a3db0d], 0xc3469c
movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0xe], ebp
xlatb
pushfd
push 0xe39cc0a6
pushfd
mov byte [0xb073c71d], al
push esi
imul edi, dword [edx + 0x27f734e2], 0x19
push es
mov dh, 3
mov ecx, 0x4de2ddc2
jb 0x48bbb9
ret
cmpsd dword [esi], dword es:[edi]
invalid
mov ebp, 0xeb7658c7
jno 0x48bb4d
xor dword [0x71a61cd3], ebx
cwde
and ecx, ecx
xchg byte [ecx], bh
pop ebx
cmpsd dword ss:[esi], dword es:[edi]
or dl, bl
sbb eax, 0x84d31a7d
in eax, 0x99
pop ebx
sbb eax, 0x320a3da6
xor dword [edx], ebx
jno 0x48bba9
invalid
imul eax, dword [esi - 0x72], 0xa4590c93
pop eax
sbb dword [esi + 0x67], 0x4e
jnp 0x48bb84
popal
lcall 0x67bd, 0x6b4cf4e2
rcr dword [edi], cl
cmp dword [ebx - 0x71], ebp
xlatb
xchg byte [ebx], ch
stosb byte es:[edi], al
ror dword [esi + 0x19a79cc3], cl
or eax, 0xe1678173
xchg edx, eax
jecxz 0x48bbb4
aaa
lodsb al, byte [esi]
xor dword [esi], ebp
arpl word [edx + 0x4c669ceb], cx
neg dword [edi + ebp*4]
or eax, 0xa615d6d3
sbb dword [edi], esi
push ss
sub byte [edx - 0x64], bl
imul si, word [ebx - 0x33], 0xde61
cmp dword [0x55af0cf1], edx
xchg edx, eax
cmp eax, 0xe7bb6f5
push cs
aaa
mov bh, 9
sar dword [edi], cl
mov ss, edx
or byte [edi - 0x18d20aef], ah
sub eax, 0xab397b0e
xor ebp, eax
mov word [ecx - 0x74], gs
shl esi, 1
cmp ch, ch
cwde
dec esi
wait
and al, 9
test byte [ecx - 0x62], ah
push ebx
xor al, 0x87
jns 0x48bc46
mov ds, ebx
mov word [ecx - 0x59], gs
sbb edx, ebx
pushfd
jbe 0x48bc46
mov bh, 0x98
arpl dx, di
and esi, dword [eax + ecx]
jno 0x48bc20
out dx, al
ret
Function at 0x48cc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
shl eax, 1
movsx edx, byte [eax + 0x4da958]
cmp ecx, edx
jle 0x48cc27
movsx eax, byte [eax + 0x4da959]
mov dword [esi + 0xc], eax
cmp ecx, 2
jne 0x48cc39
cmp dword [esi + 0x1c], 1
jne 0x48cc39
mov dword [esi + 0x10], 3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x48cd94
movsx ecx, byte [eax*2 + 0x4da958]
cmp ecx, dword [esi + 0x10]
jne 0x48cd94
cmp eax, 0x1c
jne 0x48cc7c
mov ecx, dword [esi + 0x18]
mov eax, ecx
and eax, 0x80000003
jns 0x48cc6b
dec eax
or eax, 0xfffffffc
inc eax
je 0x48cc76
mov edx, 4
sub edx, eax
mov eax, edx
lea ebx, [ecx + eax + 4]
jmp 0x48cc81
mov ebx, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
mov edi, ecx
mov dword [ebp - 4], ebx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jle 0x48ccd4
mov edx, dword [esi]
sub edx, eax
lea eax, [ecx + 1]
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
shl eax, 9
push ecx
push eax
mov dword [ebp + 8], edx
call fcn.0047e400
add esp, 8
test eax, eax
jne 0x48cd99
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 8]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi + 4]
mov edi, ecx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jg 0x48cc96
mov eax, dword [esi + 0xc]
cmp eax, 0x1c
je 0x48cd3f
mov ecx, dword [esi]
and eax, 0xff
pop edi
mov edx, dword [ecx]
and edx, 0xffff0000
xor edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x20]
and eax, 0xff
and edx, 0xff00ffff
shl eax, 0x10
or eax, edx
mov dword [ecx], eax
mov edx, dword [esi + 0x1c]
shl edx, 0x18
and eax, 0xffffff
or edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x18]
mov dword [ecx + 8], edx
mov ecx, dword [esi]
mov eax, dword [esi + 8]
add ecx, 0xc
add eax, 0xc
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov cl, byte [esi + 0xc]
mov byte [eax], cl
mov dx, word [esi + 0x18]
mov word [eax + 2], dx
mov byte [eax + 1], 0
mov edi, dword [esi + 0x14]
lea edx, [eax + 4]
mov eax, dword [esi + 0x18]
xor ecx, ecx
test eax, eax
jle 0x48cd76
mov eax, edx
sub edi, edx
mov bl, byte [edi + eax]
inc ecx
mov byte [eax], bl
mov ebx, dword [esi + 0x18]
inc eax
cmp ecx, ebx
jl 0x48cd65
mov ebx, dword [ebp - 4]
lea eax, [edx + ebx - 4]
mov dword [esi + 0xc], 0
mov dword [esi], eax
mov eax, dword [esi + 8]
add eax, ebx
pop edi
mov dword [esi + 8], eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc000003e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret