joyce8/EMBER2024-capa huggingface dataset:
Function at 0x545680
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov dword [ecx + 0x54], 0x67452301
mov dword [ecx + 0x58], 0xefcdab89
mov dword [ecx + 0x5c], 0x98badcfe
mov dword [ecx + 0x60], 0x10325476
mov dword [ecx + 0x64], 0xc3d2e1f0
mov dword [ecx + 0x68], 0x76543210
mov dword [ecx + 0x6c], 0xfedcba98
mov dword [ecx + 0x70], 0x89abcdef
mov dword [ecx + 0x74], 0x1234567
mov dword [ecx + 0x78], 0x3c2d1e0f
mov dword [ecx + 0x50], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret

Function at 0x5457e0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0x68bb6c
mov eax, ecx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x545860
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x54598a
push 0x4e28
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.00477830
mov esi, eax
add esp, 4
test esi, esi
je 0x54598a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], 0
mov byte [ebp - 9], 1
call fcn.005688c0
test al, al
jne 0x545961
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push ebx
push eax
push 0x4e20
push esi
call fcn.00568b20
test al, al
je 0x545961
mov eax, dword [ebp - 8]
test eax, eax
je 0x545942
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x545922
push eax
push esi
call fcn.0049f210
mov eax, dword [ebp - 8]
push eax
push esi
mov ecx, edi
call fcn.005461c0
test ebx, ebx
je 0x545942
push dword [ebp - 0x14]
mov ecx, ebx
push 0
push dword [ebp - 8]
call fcn.00518bd0
test al, al
jne 0x545950
mov ecx, dword [ebp - 0x10]
call fcn.005688c0
test al, al
je 0x5458f0
jmp 0x545961
mov ecx, dword [ebp - 0x14]
push str.MD4_aborted_by_application
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 9], 0
push esi
call fcn.00622535
add esp, 4
mov ecx, edi
push dword [ebp - 0x1c]
call fcn.005459a0
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x14
Function at 0x570e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636934
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x717f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x40
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call fcn.006222af
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x570ec4
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
call fcn.00476f20
mov dword [esi], 0x692cd8
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov word [esi + 0x20], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 0xce
mov byte [esi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x574400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636c46
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x717f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov dword [esi], 0x6955b4
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x100
call fcn.0049ead0
lea ecx, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
call fcn.0049ead0
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.0049ead0
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 2
call fcn.0049ead0
mov dword [esi + 0x88], 0
mov eax, esi
mov byte [esi + 0xac], 1
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xc8], 0x80
mov byte [esi + 0xcc], 0
mov byte [esi + 0x2c], 1
mov byte [esi + 0x4c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x585550
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x637b20
mov eax, dword fs:[0]
push eax
sub esp, 0x860
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov ecx, esi
mov edi, dword [ebp + 0xc]
call fcn.004d90e0
push edi
mov ecx, esi
call fcn.004d9240
test al, al
je 0x5855b0
mov byte [esi + 0x15], 1
mov ecx, edi
mov eax, dword [edi]
push str.Wait_for_data_on_socket_aborted_by_app
call dword [eax + 0x14]
xor al, al
jmp 0x585686
cmp dword [ebx + 0x28c], 0xffffffff
jne 0x5855d0
mov eax, dword [edi]
mov ecx, edi
push str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
call dword [eax + 0x14]
mov byte [esi + 0x16], 1
xor al, al
jmp 0x585686
lea ecx, [ebp - 0x86c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00476f40
mov dword [ebp - 0x86c], 0x696660
mov dword [ebp - 0x864], 0x3004bc8d
mov dword [ebp - 0x1c], 0x3004bc8d
push 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x860], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp - 0x864], 0x3004bc8d
je 0x58563b
push 0
call fcn.00401ab0
add esp, 4
cmp dword [ebp - 0x1c], 0x3004bc8d
je 0x58564e
push 0
call fcn.00401ab0
add esp, 4
mov edx, dword [ebx + 0x28c]
test edx, edx
jns 0x5856a4
mov byte [esi + 0x16], 1
xor bl, bl
lea ecx, [ebp - 0x86c]
mov dword [ebp - 0x86c], 0x696660
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x1c], 0
call fcn.00476fe0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x860]
xor eax, eax
test ecx, ecx
je 0x5856be
cmp dword [ebp + eax*4 - 0x85c], edx
je 0x5856be
inc eax
cmp eax, ecx
jb 0x5856b0
cmp eax, ecx
jne 0x5856d7
cmp ecx, 0x200
jae 0x5856d7
mov dword [ebp + eax*4 - 0x85c], edx
inc dword [ebp - 0x860]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x860]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x58565c
test eax, eax
js 0x58565c
jne 0x58570a
mov byte [esi + 0x14], 1
jmp 0x58565c
mov bl, 1
jmp 0x58565e

Function at 0x585d90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [esi + 0x28c], 0xffffffff
je 0x585e00
cmp byte [ebp + 8], 0
mov al, byte [ecx + 0x129]
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
je 0x585ddc
test al, al
je 0x585dd7
mov eax, dword [ecx]
push str.Turning_on_TCP_NODELAY.
call dword [eax + 0x18]
lea eax, [ebp - 8]
jmp 0x585ded
test al, al
je 0x585dea
mov eax, dword [ecx]
push str.Turning_off_TCP_NODELAY.
call dword [eax + 0x18]
lea eax, [ebp - 0xc]
push 4
push eax
push 1
push 6
push dword [esi + 0x28c]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00622073
mov esp, ebp
pop ebp
ret 8
Function at 0x5e5fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ea05
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp + 0x14]
xorps xmm0, xmm0
mov edi, dword [ebp + 0x10]
push str.readUntilRcvWindowAdjust
push esi
mov dword [ebp - 0x84], eax
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
call fcn.004b2490
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_GetTickCount
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
cmp dword [ebx + 0xb0], 0
jne 0x5e60e8
push 0x64
lea eax, [ebp - 0x80]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.005e0870
mov eax, dword [ebp - 0x84]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x74], 0
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x70], eax
call fcn.004d90e0
mov ecx, dword [ebp - 0x88]
push esi
push edi
push dword [ebp - 0x84]
call fcn.005e6ec0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x5e6087
push esi
call fcn.00518b10
test al, al
jne 0x5e6112
mov ecx, edi
call fcn.004d9090
test al, al
jne 0x5e6157
cmp byte [ebp - 0x51], al
jne 0x5e6149
cmp byte [ebp - 0x53], al
jne 0x5e613b
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x8c]
cmp eax, 0xea60
ja 0x5e6120
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
mov dword [ebp - 0x80], 0x6c6d48
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0
call fcn.0049ecf0
cmp dword [ebx + 0xb0], 0
je 0x5e6022
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.004b2630
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
mov ecx, esi
push str.aborted_by_user_application.
call dword [eax + 0x14]
jmp 0x5e6164
mov ecx, dword [ebp - 0x88]
push esi
push edi
call fcn.005e1850
mov eax, dword [esi]
mov ecx, esi
push str.No_WINDOW_ADJUST_seems_to_be_coming...
call dword [eax + 0x14]
jmp 0x5e6164
mov eax, dword [esi]
mov ecx, esi
push str.Received_CHANNEL_CLOSE
call dword [eax + 0x14]
jmp 0x5e6164
mov eax, dword [esi]
mov ecx, esi
push str.Received_DISCONNECT
call dword [eax + 0x14]
jmp 0x5e6164
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.004d9190
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x80], 0x6c6d48
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0
call fcn.0049ecf0
xor bl, bl
jmp 0x5e60ea
Function at 0x6126d0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x716a20
ret

Function at 0x6126e0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x716a68
ret

Function at 0x613770
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
sub eax, 2
je 0x613848
sub eax, 1
je 0x6137f8
sub eax, 1
jne 0x6137e4
movzx eax, byte [ebp - 8]
mov cl, byte [edi + edx*4 + 0x18]
xor cl, byte [eax + 0x6ce988]
movzx eax, byte [ebp - 7]
mov bl, byte [eax + 0x6ce888]
movzx eax, byte [ebp - 6]
xor bl, byte [edi + edx*4 + 0x19]
mov ch, byte [eax + 0x6ce888]
movzx eax, byte [ebp - 5]
xor ch, byte [edi + edx*4 + 0x1a]
mov bh, byte [eax + 0x6ce988]
xor bh, byte [edi + edx*4 + 0x1b]
jmp 0x613804
mov cl, byte [ebp - 8]
mov al, byte [ebp - 5]
mov bl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov byte [ebp - 9], cl
jmp 0x6138f4
mov bh, byte [ebp - 5]
mov ch, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov cl, byte [ebp - 8]
movzx eax, cl
mov cl, byte [edi + edx*4 + 0x10]
xor cl, byte [eax + 0x6ce988]
movzx eax, bl
mov byte [ebp - 9], cl
mov bl, byte [eax + 0x6ce988]
xor bl, byte [edi + edx*4 + 0x11]
movzx eax, ch
mov al, byte [eax + 0x6ce888]
xor al, byte [edi + edx*4 + 0x12]
mov byte [ebp - 0xa], al
movzx eax, bh
mov bh, byte [ebp - 0xa]
mov al, byte [eax + 0x6ce888]
xor al, byte [edi + edx*4 + 0x13]
mov byte [ebp - 0xb], al
mov al, cl
jmp 0x613857
mov al, byte [ebp - 5]
mov bh, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov byte [ebp - 0xb], al
mov al, byte [ebp - 8]
movzx ecx, byte [edi + edx*4 + 8]
movzx eax, al
movzx eax, byte [eax + 0x6ce888]
xor ecx, eax
movzx eax, byte [edi + edx*4]
movzx ecx, byte [ecx + 0x6ce888]
xor ecx, eax
mov al, byte [ecx + 0x6ce988]
mov byte [ebp - 9], al
movzx eax, bl
movzx ecx, byte [eax + 0x6ce988]
movzx eax, byte [edi + edx*4 + 9]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 1]
movzx ecx, byte [ecx + 0x6ce888]
xor ecx, eax
mov al, byte [ecx + 0x6ce888]
mov byte [ebp - 0xa], al
movzx eax, bh
mov bh, byte [ebp - 0xa]
movzx ecx, byte [eax + 0x6ce888]
movzx eax, byte [edi + edx*4 + 0xa]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 2]
movzx ecx, byte [ecx + 0x6ce988]
xor ecx, eax
movzx eax, byte [ebp - 0xb]
mov bl, byte [ecx + 0x6ce988]
movzx ecx, byte [eax + 0x6ce988]
movzx eax, byte [edi + edx*4 + 0xb]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 3]
movzx ecx, byte [ecx + 0x6ce988]
xor ecx, eax
mov al, byte [ecx + 0x6ce888]
movzx eax, al
movzx ecx, bl
pop edi
mov edx, dword [eax*4 + 0x6cf688]
xor edx, dword [ecx*4 + 0x6cf288]
mov ecx, dword [ebp - 4]
movzx eax, bh
xor ecx, ebp
xor edx, dword [eax*4 + 0x6cee88]
movzx eax, byte [ebp - 9]
xor edx, dword [eax*4 + 0x6cea88]
mov eax, edx
mov byte [esi], dl
shr eax, 0x18
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 2], al
mov eax, edx
shr eax, 8
mov byte [esi + 1], al
pop esi
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x61fd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x64]
mov ecx, eax
mov edi, dword [esi + 0x2c]
mov edx, dword [esi + 0x6c]
sub edi, eax
sub edi, edx
jne 0x61fd44
test eax, eax
jne 0x61fd53
test edx, edx
jne 0x61fd53
mov edi, ebx
jmp 0x61fde7
cmp edi, 0xffffffff
jne 0x61fd53
mov edi, 0xfffffffe
jmp 0x61fde7
mov eax, dword [esi + 0x1c]
add eax, 0xfffffefa
add eax, ebx
cmp ecx, eax
jb 0x61fde7
mov ecx, dword [esi + 0x28]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
sub dword [esi + 0x68], ebx
add esp, 0xc
sub dword [esi + 0x64], ebx
sub dword [esi + 0x54], ebx
mov eax, dword [esi + 0x38]
mov ebx, dword [esi + 0x44]
lea edx, [eax + ebx*2]
mov eax, dword [ebp - 4]
movzx esi, ax
nop
mov cx, word [edx - 2]
lea edx, [edx - 2]
sub cx, si
mov ax, cx
not ax
sar ax, 0xf
and ax, cx
mov word [edx], ax
sub ebx, 1
jne 0x61fd90
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ebx, ecx
mov eax, dword [esi + 0x30]
movzx esi, cx
lea eax, [eax + ecx*2]
mov dx, word [eax - 2]
lea eax, [eax - 2]
sub dx, si
mov cx, dx
not cx
sar cx, 0xf
and cx, dx
mov word [eax], cx
sub ebx, 1
jne 0x61fdc0
mov ebx, dword [ebp - 4]
add edi, ebx
mov esi, dword [ebp - 8]
mov ecx, dword [esi + 4]
call fcn.004c73b0
test eax, eax
je 0x61fe48
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x28]
add eax, dword [esi + 0x64]
mov ecx, dword [esi + 4]
push edi
push eax
call fcn.0061a1b0
mov edi, dword [esi + 0x6c]
add edi, eax
mov dword [esi + 0x6c], edi
cmp edi, 3
jb 0x61fe30
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x50]
movzx edx, byte [eax]
mov dword [esi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [esi + 0x4c]
mov dword [esi + 0x40], edx
cmp edi, 0x106
jae 0x61fe48
mov ecx, dword [esi + 4]
call fcn.004c73b0
test eax, eax
jne 0x61fd24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x621d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6413e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x717f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi], 0x6d58f4
mov dword [edi + 8], 0xfa0
mov dword [edi + 0xc], 0
call fcn.0049ead0
push 0x1388
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov byte [edi + 0x40], 0
call fcn.004a2730
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4f5d0ad6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x188b24b7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4aacc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5bfc40]
xor edx, edx
cmp eax, edx
jne 0x4aace6
xor eax, eax
mov byte [eax + 0x5bfb40], al
inc eax
cmp eax, 0x100
jl 0x4aacce
mov dword [0x5bfc40], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5bfb40
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4aad77
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4aad4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4aad18
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4aadf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4aae43
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4aae2a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4af301
cmp eax, 8
jg 0x4af301
cmp dword [esp + 0x8c], 2
jl 0x4af301
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4af301
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4af301
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4af167
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4af2ea
mov ebp, dword [0x51d56c]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4af199
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4af2d1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4af1b9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x51d55c]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4af1f8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x51d560]
lea ecx, [esp + 0x28]
push ecx
call dword [0x51d5fc]
test eax, eax
jne 0x4af2b8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004ae6f0
cmp eax, 1
jne 0x4af2e2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004aefa0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4af1ad
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4af2ea
jmp 0x4af184
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004ae2f0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c