joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f8e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10095924
call fcn.0051a7d4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00488344
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00488344
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov al, byte [edi + 0x2d]
mov byte [esi + 0x2d], al
mov al, byte [edi + 0x2e]
mov byte [esi + 0x2e], al
mov al, byte [edi + 0x2f]
mov byte [esi + 0x2f], al
mov al, byte [edi + 0x30]
mov byte [esi + 0x30], al
mov al, byte [edi + 0x31]
mov byte [esi + 0x31], al
mov ax, word [edi + 0x32]
mov word [esi + 0x32], ax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4951ce
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009604b
call fcn.0051a7d4
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x1009f644
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.004886d6
mov ecx, dword [ebp - 0xc]
push 4
pop eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], 0x1009f840
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x2c], 0x1009f838
mov dword [esi], 0x1009f804
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x49a982
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edi, edi
mov ax, word [esi]
jbe 0x49a9b2
push ebx
movzx ecx, byte [edx]
movzx ebx, al
xor ecx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [ecx*2 + 0x100b9184]
xor ax, bx
inc edx
dec edi
jne 0x49a996
pop ebx
mov word [esi], ax
pop edi
pop esi
ret 8
Function at 0x4ac000
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x10097ae4
call fcn.0051a7d4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 3
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.004886d6
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004886d6
or dword [esi + 0x60], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
mov byte [esi + 0x4a], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4ad3e4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10097ca0
call fcn.0051a7d4
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.00488344
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.00488344
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov al, byte [esi + 0x48]
mov byte [ebx + 0x48], al
mov al, byte [esi + 0x49]
mov byte [ebx + 0x49], al
mov al, byte [esi + 0x4a]
mov byte [ebx + 0x4a], al
mov eax, dword [ebp + 8]
add esi, 0x4b
lea edi, [ebx + 0x4b]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x60], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4b4303
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100989e3
call fcn.0051a7d4
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x100a07d4
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x100a07cc
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.00487827
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4b6761
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1009902c
call fcn.0051a7d4
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x100a0450
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x100a07e4
push 4
mov ebx, 0x1009f848
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.004895d4
mov dword [esi + 0x3c], 0x100a0894
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.004895d4
mov dword [edi], 0x100a089c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004b31a2
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.004b5824
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004b31a2
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.004b5824
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004b31a2
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.004b5824
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004b31a2
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.004b5824
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.004b5824
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4bfb75
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov eax, ecx
push esi
push edi
mov edi, dword [eax]
cmp dword [ebp + 0xc], 0
je 0x4bfbc4
mov esi, dword [eax + 4]
test esi, esi
je 0x4bfbc4
mov cl, byte [edx]
inc edx
mov byte [esi + eax + 8], cl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec dword [ebp + 0xc]
test ecx, ecx
mov dword [eax + 4], ecx
jne 0x4bfb82
and dword [ebp + 8], ecx
lea esi, [eax + 8]
movzx ebx, byte [esi]
mov ecx, dword [ebp + 8]
add dword [ebp + 8], 8
shl ebx, cl
xor edi, ebx
inc esi
cmp dword [ebp + 8], 0x20
jl 0x4bfbad
jmp 0x4bfb82
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov esi, ecx
dec ecx
test esi, esi
je 0x4bfbf4
inc ecx
movzx esi, byte [edx]
inc edx
xor ebx, ebx
mov bh, byte [edx]
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x10
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x18
or esi, ebx
inc edx
xor edi, esi
dec ecx
jne 0x4bfbd2
mov esi, dword [ebp + 0xc]
mov dword [eax], edi
and esi, 3
je 0x4bfc15
mov ecx, dword [eax + 4]
mov bl, byte [edx]
inc edx
mov byte [ecx + eax + 8], bl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec esi
mov dword [eax + 4], ecx
jne 0x4bfbfe
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4bfd5d
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
xor esi, esi
mov edx, dword [eax + 4]
test edx, edx
jle 0x4bfd83
push edi
lea ecx, [edx*8 - 8]
movzx edi, byte [eax + esi + 8]
shl edi, cl
sub ecx, 8
xor dword [eax], edi
inc esi
cmp esi, edx
jl 0x4bfd71
pop edi
pop esi
ret

Function at 0x4c99ab
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009a66c
call fcn.0051a7d4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00488a84
mov eax, dword [edi + 0xc]
and dword [ebp - 4], 0
mov dword [esi + 0xc], eax
mov ax, word [edi + 0x10]
mov word [esi + 0x10], ax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
lea ecx, [esi + 0x34]
push edi
mov dword [esi + 0x30], eax
call fcn.004c9a96
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4ce42c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1009ad26
call fcn.0051a7d4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00488344
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00488a84
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00488344
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00488a84
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov al, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov al, byte [edi + 0x39]
mov byte [esi + 0x39], al
mov al, byte [edi + 0x3a]
mov byte [esi + 0x3a], al
mov al, byte [edi + 0x3b]
mov byte [esi + 0x3b], al
mov al, byte [edi + 0x3c]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4d158e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1009b20b
call fcn.0051a7d4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.00488344
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.00488a84
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4d4475
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1009b62a
call fcn.0051a7d4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x18]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push eax
call fcn.00488344
and dword [ebp - 4], 0
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.00488344
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00488344
mov al, byte [edi + 0x3c]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov al, byte [edi + 0x3e]
mov byte [esi + 0x3e], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4d6983
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x4d69b2
push ebx
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x100b93a4]
xor ax, bx
inc ecx
dec esi
jne 0x4d6992
pop edi
pop ebx
pop esi
ret 4
Function at 0x4d83c9
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1009b9fa
call fcn.0051a7d4
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
lea ecx, [ebx + 0x34]
xor esi, esi
push eax
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], 0x1009f5c4
call fcn.004d1649
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x40]
lea eax, [esi + 0x40]
push eax
call fcn.004d84ae
add esi, 0x54
lea ecx, [ebx + 0x54]
push esi
mov byte [ebp - 4], 1
call fcn.004d84fa
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4de2b4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009c2cc
call fcn.0051a7d4
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.00488a84
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.00488a84
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
add esi, 0x1c
lea edi, [ebx + 0x1c]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x30]
pop edi
mov dword [ebx + 0x30], ecx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x38], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x44]
mov dword [ebx + 0x44], ecx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [ebx + 0x50], ecx
mov al, byte [eax + 0x54]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0x54], al
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4eac5a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009d29c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a0744
mov dword [esi + 4], 0x100a1168
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov dword [esi + 8], edi
call fcn.0048aacf
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.0048aacf
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.0048aacf
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.0048aacf
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4a0], edi
mov dword [esi + 0x4a4], edi
mov dword [esi + 0x4b4], edi
mov eax, 0x100000
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov dword [esi + 0x4d8], 0x10000
mov dword [esi], 0x100a1158
mov dword [esi + 4], 0x100a1144
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4ebf4a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009d3db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x100a131c
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.0048aacf
mov dword [esi + 0x6fe4], edi
lea ecx, [esi + 0x6ff8]
mov dword [esi + 0x6ff4], edi
call fcn.00517064
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x100a1304
mov dword [esi + 4], 0x100a12f4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4eed44
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.004ee404
push 0x41
mov ecx, esi
call fcn.004ee404
push 0x59
mov ecx, esi
call fcn.004ee404
push 0x26
mov ecx, esi
call fcn.004ee404
push 0x53
mov ecx, esi
call fcn.004ee404
push 0x59
mov ecx, esi
call fcn.004ee404
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x4eedd4
test cl, cl
jbe 0x4eedd0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100b96ac]
xor eax, edi
dec ecx
jne 0x4eedba
xor edi, edi
jmp 0x4eee03
cmp bl, cl
jne 0x4eeddb
inc edi
jmp 0x4eede6
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100b96ac]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x4eed92
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.004ee444
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.004ee544
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x4ef014
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.004eee44
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0x4ef090
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.00516ec4
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x4ef0cd
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x4ef0a2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.004ef1a4
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0x4ef18b
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0x4ef118
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0x4ef168
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.0048c63d
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.00516f14
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4fa994
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov eax, ecx
push edi
imul eax, dword [esp + 0x18]
div ebp
xor edx, edx
lea edi, [eax + ebx - 1]
mov eax, ecx
imul eax, dword [esp + 0x14]
div ebp
mov ecx, dword [esi + 8]
mov ebp, 0x10000
sub ecx, eax
add ebx, eax
mov dword [esi + 8], ecx
mov dword [esi], ebx
Function at 0x4fb06b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009db0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x1009f210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.0048aacf
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x88], bl
mov dword [esi], 0x100a1938
mov dword [esi + 4], 0x100a1928
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret