joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f1d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6009bd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69ee98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ebx + 0x230]
lea edi, [edx - 1]
test edi, edi
js 0x41f253
lea ebx, [ebx]
test edi, edi
js 0x41f3fb
cmp edi, edx
jge 0x41f3fb
mov eax, dword [ebx + 0x22c]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x41f24b
mov eax, dword [ebx]
push 1
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebx + 0x230]
jmp 0x41f24e
mov ebx, dword [ebp - 0x10]
sub edi, 1
jns 0x41f210
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x228]
call fcn.004970f9
push ecx
mov edi, esp
mov dword [ebp - 0x14], edi
call fcn.00485933
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41f3f1
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x613aec]
mov ecx, dword [ebp - 0x10]
call esi
add eax, 0x10
mov dword [edi], eax
mov eax, 0x674642
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x41f2af
movzx eax, ax
push eax
call fcn.004030c0
jmp 0x41f2bb
push 0
push 0x674642
call fcn.004038a0
push 0
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0041f410
mov eax, dword [0x6a963c]
test eax, eax
je 0x41f2e9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x6a963c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x6c7aa8]
test eax, eax
je 0x41f2fd
push 4
push eax
call fcn.005d4edd
add esp, 8
mov ecx, ebx
call fcn.004987b0
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [0x6a95a0]
test ecx, ecx
je 0x41f32b
push 1
push ecx
call fcn.005d4edd
add esp, 8
mov dword [0x6a95a0], 0
mov eax, dword [0x6a95a8]
test eax, eax
je 0x41f349
push 1
push eax
call fcn.005d4edd
add esp, 8
mov dword [0x6a95a8], 0
mov eax, dword [0x6a95b4]
test eax, eax
je 0x41f367
push 1
push eax
call fcn.005d4edd
add esp, 8
mov dword [0x6a95b4], 0
mov eax, dword [0x6a959c]
test eax, eax
je 0x41f385
push 1
push eax
call fcn.005d4edd
add esp, 8
mov dword [0x6a959c], 0
mov eax, dword [0x6a9598]
test eax, eax
je 0x41f3a3
push 1
push eax
call fcn.005d4edd
add esp, 8
mov dword [0x6a9598], 0
mov eax, dword [0x6a95b0]
test eax, eax
je 0x41f3c1
push 1
push eax
call fcn.005d4edd
add esp, 8
mov dword [0x6a95b0], 0
test esi, esi
jne 0x41f3dd
mov eax, dword [ebx + 0x298]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402cb0
call fcn.00486c16
int3
Function at 0x41f9a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600ac0
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x69ee98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x90
push 0
lea eax, [esi + 4]
push eax
call fcn.005d7470
add esp, 0xc
mov dword [esi], 0x94
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x41fa00
mov eax, 1
jmp 0x41fa8c
cmp eax, 1
jne 0x41fa31
cmp dword [esi + 4], 4
jne 0x41fa83
mov eax, dword [esi + 8]
test eax, eax
jne 0x41fa19
mov eax, 2
jmp 0x41fa8c
cmp eax, 0xa
jne 0x41fa25
mov eax, 3
jmp 0x41fa8c
cmp eax, 0x5a
jne 0x41fa83
mov eax, 6
jmp 0x41fa8c
cmp eax, 2
jne 0x41fa8a
mov eax, dword [esi + 4]
cmp eax, 3
jne 0x41fa45
mov eax, 4
jmp 0x41fa8c
cmp eax, 4
jne 0x41fa64
mov eax, dword [esi + 8]
cmp eax, 0x5a
jne 0x41fa59
mov eax, 6
jmp 0x41fa8c
test eax, eax
jne 0x41fa83
mov eax, 5
jmp 0x41fa8c
cmp eax, 5
jne 0x41fa83
mov eax, dword [esi + 8]
test eax, eax
jne 0x41fa77
mov eax, 8
jmp 0x41fa8c
cmp eax, 1
jne 0x41fa83
mov eax, 7
jmp 0x41fa8c
mov eax, dword [0x6a9640]
jmp 0x41fa91
xor eax, eax
mov dword [0x6a9640], eax
cmp eax, 2
je 0x41fac6
push str.powrprof.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41fac6
push 0xe8
lea eax, [ebp - 0xf8]
push eax
push 0
push 0
push 8
call dword [sym.imp.POWRPROF.dll_CallNtPowerInformation]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret 4
Function at 0x441730
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x602280
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x69ee98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0
push 0x8000080
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x4417df
mov dword [esi + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x1e
ja case.0x4417a6.2
movzx eax, byte [eax + 0x4418b4]
jmp dword [eax*4 + 0x4418a4]
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push dword [esi + 0x18]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x441832
mov eax, dword [esi + 0x18]
test eax, eax
je 0x441812
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov eax, 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
test eax, eax
je case.0x4417a6.5
push ebx
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
call fcn.0043fe20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebx]
mov edi, eax
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
mov ecx, dword [ebx]
push edi
mov esi, dword [ecx + 0x40]
mov ecx, esi
call dword [0x613aec]
mov ecx, ebx
call esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44b8a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x69ee98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x44b8c6
mov eax, 0xa
push eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x44b90e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FindResource_Failed__Code__i_._n
lea eax, [ebp - 0x204]
push eax
call fcn.0040a470
add esp, 0xc
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x44b92b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadResource_Failed__Code__i_._n
jmp 0x44b8e8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x44b94f
lea eax, [ebx + 4]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 0x104]
push str.Resource:__i
push eax
call fcn.0040a470
add esp, 0xc
lea eax, [ebp - 0x104]
mov ecx, edi
push esi
push eax
call fcn.0043fe20
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi + 0x20], ebx
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4527b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x69ee98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [eax + 8]
mov byte [ebp - 0x15], cl
cmp cl, 3
je 0x452999
push ebx
mov ebx, dword [eax]
xor edx, edx
push edi
movzx edi, byte [eax + 9]
test cl, 2
mov eax, dword [ebp + 0x10]
mov ecx, edi
je 0x452813
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edi
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edi
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [edx + 3]
jmp 0x452821
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x45283b
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edi, eax
mov dword [ebp + ecx*4 - 0x14], edi
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x452883.3
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x452856
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x45285b
mov edx, 1
inc eax
cmp eax, ecx
jl 0x452845
test dx, dx
je case.0x452883.3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x452883.3
movzx eax, byte [eax + 0x4529bc]
jmp dword [eax*4 + 0x4529a8]
mov ecx, dword [edx + 4]
test ecx, ecx
je case.0x452883.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x452895
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edx + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x452883.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x4528d8
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x452883.3
lea ebx, [ebx]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x452910
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x452883.3
mov edi, 0x100
lea ecx, [ecx]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x452950
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005d4ba5
mov esp, ebp
pop ebp
ret
Function at 0x458de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x458dec
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00458e00
Function at 0x45e6e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, word [esi + 0x1e]
cmp eax, 6
ja case.0x45e6f9.4
jmp dword [eax*4 + 0x45e8b8]
cmp word [esi + 0x18], 8
je case.0x45e6f9.4
mov cl, byte [esi + 0x18]
mov eax, 1
shl eax, cl
push eax
lea edi, [eax - 1]
call fcn.0044d8f0
add esp, 4
mov dword [esi + 0x34], eax
test eax, eax
jne 0x45e749
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.0045d240
add esp, 4
push eax
call fcn.00462ab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp word [esi + 0x1e], bx
jne 0x45e77b
test edi, edi
js 0x45e79d
imul eax, edi, 0xff
mov dword [ebp - 4], eax
mov edi, edi
cdq
idiv edi
mov ecx, dword [esi + 0x34]
mov byte [ebx + ecx], al
inc ebx
mov eax, dword [ebp - 4]
sub eax, 0xff
mov dword [ebp - 4], eax
cmp ebx, edi
jle 0x45e760
jmp 0x45e79d
test edi, edi
js 0x45e79d
xor eax, eax
mov dword [ebp - 4], eax
cdq
idiv edi
mov ecx, dword [esi + 0x34]
mov byte [ebx + ecx], al
inc ebx
mov eax, dword [ebp - 4]
add eax, 0xff
mov dword [ebp - 4], eax
cmp ebx, edi
jle 0x45e784
cmp word [esi + 0x18], 8
ja case.0x45e6f9.4
movzx eax, word [esi + 0x1e]
cmp eax, 1
je 0x45e7b2
test ax, ax
jne case.0x45e6f9.4
push esi
call fcn.0045f070
add esp, 4
test eax, eax
jne 0x45e7c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x34]
call fcn.0044d8e0
add esp, 4
mov dword [esi + 0x34], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov edx, dword [esi + 0x20]
mov ebx, dword [esi + 0x28]
mov edi, dword [esi + 0x24]
shl eax, cl
mov ecx, eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test ecx, ecx
jle 0x45e839
mov dword [ebp - 4], 0x100
lea ecx, [ecx]
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [ebp - 4]
jae 0x45e86e
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 4]
jae 0x45e86e
mov ax, word [ebx]
add ebx, 2
cmp ax, word [ebp - 4]
jae 0x45e86e
test ecx, ecx
jg 0x45e810
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.0045d240
add esp, 4
push eax
call fcn.00462b20
add esp, 8
cmp word [esi + 0x18], 8
ja case.0x45e6f9.4
push esi
call fcn.0045f330
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
add edx, 0xffffffff
js 0x45e851
mov eax, dword [esi + 0x24]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
sub ebx, eax
sub edi, eax
lea ecx, [eax + edx*2]
jmp 0x45e890
sub edx, 1
movzx eax, byte [ebx + ecx + 1]
mov word [ebx + ecx], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [edi + ecx + 3]
mov word [edi + ecx + 2], ax
jns 0x45e890
jmp 0x45e851
Function at 0x470a10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x470a47
push esi
call fcn.00474f80
add esp, 4
cmp byte [esi + 0x40], 0
je 0x470a3e
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x470a52
cmp eax, 0xcb
jne 0x470ade
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x470ac8
mov edi, edi
mov edi, dword [esi + 8]
test edi, edi
je 0x470a77
mov edi, dword [edi]
mov ecx, edi
push esi
call dword [0x613aec]
call edi
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov edi, dword [eax]
mov ecx, edi
call dword [0x613aec]
call edi
add esp, 4
test eax, eax
je 0x470ac2
cmp eax, 2
je 0x470ac8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x470a60
cmp eax, 3
je 0x470aa7
cmp eax, 1
jne 0x470a60
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x470a60
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x470a60
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00470b20
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x470b08
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x613aec]
call edi
add esp, 4
push esi
call fcn.00470b20
add esp, 4
pop edi
pop esi
pop ebp
ret
Function at 0x470b20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
lea eax, [esi + 0x180]
lea ebx, [esi + 0x78]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
je 0x470b6b
mov eax, dword [eax]
push esi
mov edi, dword [eax]
mov ecx, edi
call dword [0x613aec]
call edi
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
lea eax, [esi + 0x180]
jmp 0x470b71
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov eax, dword [eax]
cmp byte [eax + 8], 0
je 0x470c1e
lea ecx, [ecx]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x470bde
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x470bad
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov edi, dword [eax]
mov ecx, edi
call dword [0x613aec]
call edi
add esp, 4
mov edi, dword [esi + 0x184]
mov ebx, dword [ebx]
push 0
push dword [ebp - 4]
mov edi, dword [edi + 4]
mov ecx, edi
push 0
push esi
call dword [0x613aec]
call edi
mov eax, dword [ebp - 4]
add esp, 0x10
mov eax, dword [eax]
cmp eax, ebx
je 0x470c37
mov ebx, dword [ebp - 4]
cmp eax, dword [esi + 0x60]
jb 0x470b87
mov eax, dword [ebp - 8]
push esi
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x613aec]
call edi
mov eax, dword [ebp - 8]
add esp, 4
mov eax, dword [eax]
push esi
mov edi, dword [eax]
mov ecx, edi
call dword [0x613aec]
call edi
mov eax, dword [ebp - 8]
add esp, 4
mov dword [ebx], 0
mov eax, dword [eax]
cmp byte [eax + 8], 0
jne 0x470b80
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ac80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [edx + 0x4c]
cmp edi, 1
mov ecx, dword [edx + 0x1a8]
sete al
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edi
mov byte [ecx + 0x1c], al
lea eax, [edi - 1]
push dword [edx + 0x64]
mov esi, dword [edx + 4]
neg eax
sbb eax, eax
and eax, 0xfffffe02
mov esi, dword [esi + 8]
add eax, 0x2fe
push eax
push 1
push edx
mov ecx, esi
call dword [0x613aec]
call esi
mov esi, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp + 8]
add esp, 0x10
mov dword [ebp - 8], ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
cmp dword [ecx + 0x64], ebx
jle 0x47adba
lea esp, [esp]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
cmp edi, 1
jne 0x47ad0c
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
jmp 0x47ad30
cmp esi, edx
jle 0x47ad54
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x47ad42
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0xff
jle 0x47ad30
mov edi, dword [ebp - 0x18]
cmp edi, 1
jne 0x47ada1
mov ebx, eax
mov ecx, edi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x47ad81
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0xc]
jl 0x47acf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [ecx + 0x38]
mov edx, dword [ebx + 0x18]
cmp dword [ebx + 0x2c], edx
jge 0x484658
lea esi, [ebx + 0x44]
lea esp, [esp]
mov dl, byte [esi]
test dl, dl
jne 0x484613
mov eax, dword [ecx + 0x38]
mov edi, dword [eax + 0x3c]
test edi, edi
je 0x4845b3
push 1
push esi
push ecx
mov ecx, edi
call dword [0x613aec]
call edi
add esp, 0xc
jmp 0x4845c3
push dword [eax + 0x38]
push 1
push 1
push esi
call fcn.005e27cc
add esp, 0x10
cmp eax, 1
jne 0x484645
mov edx, dword [ebp + 8]
lea edi, [esi + 1]
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4845ef
movzx eax, byte [esi]
push eax
push edi
push edx
call dword [0x613aec]
call dword [ebp - 4]
add esp, 0xc
jmp 0x484601
push dword [eax + 0x38]
movzx eax, byte [esi]
push eax
push 1
push edi
call fcn.005e27cc
add esp, 0x10
mov dl, byte [esi]
mov ecx, eax
movzx eax, dl
cmp ecx, eax
jne 0x484645
mov al, byte [edi]
mov byte [edi], 2
jmp 0x484621
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
dec dl
movzx eax, al
mov byte [esi], dl
mov ecx, dword [ebx + 0x2c]
shl eax, cl
or dword [ebx + 0x30], eax
lea eax, [ecx + 8]
mov dword [ebx + 0x2c], eax
mov edx, dword [ebx + 0x18]
cmp eax, edx
jge 0x484658
mov ecx, dword [ebp + 8]
jmp 0x484590
pop edi
pop esi
mov dword [0x6a4fcc], 0x66
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx*4 + 0x69dfd8]
and ecx, dword [ebx + 0x30]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x18]
shr dword [ebx + 0x30], cl
sub dword [ebx + 0x2c], ecx
inc dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
cmp dword [ebx + 0x14], eax
jle 0x48468b
cmp ecx, 0xc
jge 0x48468b
add eax, eax
mov dword [ebx + 0x1c], eax
lea eax, [ecx + 1]
mov dword [ebx + 0x18], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 1]
mov esi, dword [edi + 0x38]
mov ebx, dword [esi + 0x3c]
test ebx, ebx
je 0x48497a
push 1
push eax
push edi
mov ecx, ebx
call dword [0x613aec]
call ebx
add esp, 0xc
jmp 0x48498a
push dword [esi + 0x38]
push 1
push 1
push eax
call fcn.005e27cc
add esp, 0x10
cmp eax, 1
jne 0x4849e3
mov al, byte [ebp - 1]
lea ecx, [esi + 0x44]
test al, al
je 0x4849f6
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov byte [ecx], al
mov eax, dword [edi + 0x38]
mov esi, dword [eax + 0x3c]
test esi, esi
je 0x4849c3
movzx eax, byte [ebp - 1]
mov ecx, esi
push eax
mov eax, dword [edx]
inc eax
push eax
push edi
call dword [0x613aec]
call esi
add esp, 0xc
jmp 0x4849d9
push dword [eax + 0x38]
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.005e27cc
add esp, 0x10
mov ecx, eax
movzx eax, byte [ebp - 1]
cmp ecx, eax
je 0x484a09
pop edi
pop esi
mov dword [0x6a4fcc], 0x66
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov byte [ecx], 0
mov dword [esi + 0x34], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484a20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x484a41
mov dword [0x6a4fcc], 0x6f
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [eax + 0x3c]
test edi, edi
je 0x484a5f
push 1
lea eax, [ebp - 1]
mov ecx, edi
push eax
push esi
call dword [0x613aec]
call edi
add esp, 0xc
jmp 0x484a72
push dword [eax + 0x38]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.005e27cc
add esp, 0x10
pop edi
cmp eax, 1
je 0x484a89
mov dword [0x6a4fcc], 0x66
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
movzx ecx, byte [ebp - 1]
push esi
mov dword [eax], ecx
call fcn.00484ab0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret