joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a94a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9615
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a95f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a5c
lea eax, [ebp - 0x118]
mov edx, 0x4a962c
call fcn.00404b3c
mov eax, dword [ebp - 0x118]
call fcn.00404d2c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4a9562
lea eax, [ebp - 0x111]
call fcn.00409864
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040496c
jmp 0x4a9569
mov eax, esi
call fcn.0040487c
cmp bl, 0x61
jae 0x4a958a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040d618
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004048d0
jmp 0x4a95a4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040d58c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004048d0
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4a9638
call fcn.0040a020
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004048d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a95f7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c57ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c5a4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4c584f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004c52b4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d1c4
cmp al, 1
jne 0x4c584f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004c55cc
test al, al
je 0x4c59db
cmp dword [ebp - 8], 0
jge 0x4c586d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004c52b4
mov eax, dword [ebp - 0x210]
call fcn.00404b34
cmp ebx, eax
jge 0x4c58b7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004c52b4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x50cc80]
and eax, 0xff
bt dword [edx], eax
jae 0x4c58b7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4c58cb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c57c8
cmp ebx, dword [ebp - 8]
je 0x4c59cd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4c58f7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x50c4d0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4c59ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x50c4d0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044f370
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x50c4d0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044f370
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c59c1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4c5a2e
cmp dword [ebp - 8], 0
jge 0x4c59e6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004c52b4
mov eax, dword [ebp - 0x218]
call fcn.00404b34
cmp eax, dword [ebp - 8]
jg 0x4c5a20
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004c52b4
mov eax, dword [ebp - 0x21c]
call fcn.00404b34
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c57c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5a53
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004048a0
ret
Function at 0x4cf3dc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 8
mov al, byte [ebx + 0x2b4]
test al, al
jne 0x4cf3f2
xor esi, esi
cmp al, 1
jne 0x4cf3fb
mov esi, 1
cmp al, 2
jne 0x4cf404
mov esi, 4
cmp al, 3
jne 0x4cf40d
mov esi, 8
cmp al, 4
jne 0x4cf416
mov esi, 0x18
cmp al, 5
jne 0x4cf42c
mov eax, dword [ebx + 0x208]
call fcn.00423844
call fcn.0049c40c
mov esi, eax
call fcn.004424c0
mov edx, dword [0x50c910]
mov dx, word [edx]
call fcn.00442488
test al, al
je 0x4cf4d9
mov byte [ebx + 0x3c2], 0
mov byte [ebx + 0x3d8], 0
cmp byte [ebx + 0x284], 0
je 0x4cf47d
mov eax, dword [ebx + 0x298]
call fcn.004257d4
test eax, eax
je 0x4cf47d
mov eax, dword [ebx + 0x298]
call fcn.004257d4
call fcn.0049441c
call fcn.004424c0
mov dx, 8
call fcn.00442488
test al, al
je 0x4cf4c9
mov eax, ebx
call fcn.0044f370
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4cf4d9
push 8
call sub.user32.dll_GetClipboardData
mov edi, eax
mov eax, dword [ebx + 0x298]
call fcn.004257d4
push eax
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, edi
call fcn.004a5770
call sub.user32.dll_CloseClipboard
cmp byte [ebx + 0x2ad], 0
je 0x4cf4d9
mov eax, ebx
call fcn.004cc88c
pop edi
pop esi
pop ebx
ret

Function at 0x4d6ac8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 8
mov al, byte [ebx + 0x2b5]
test al, al
jne 0x4d6ade
xor esi, esi
cmp al, 1
jne 0x4d6ae7
mov esi, 1
cmp al, 2
jne 0x4d6af0
mov esi, 4
cmp al, 3
jne 0x4d6af9
mov esi, 8
cmp al, 4
jne 0x4d6b02
mov esi, 0x18
cmp al, 5
jne 0x4d6b18
mov eax, dword [ebx + 0x208]
call fcn.00423844
call fcn.0049c40c
mov esi, eax
call fcn.004424c0
mov edx, dword [0x50c910]
mov dx, word [edx]
call fcn.00442488
test al, al
je 0x4d6bc5
mov byte [ebx + 0x3be], 0
mov byte [ebx + 0x3d4], 0
cmp byte [ebx + 0x28c], 0
je 0x4d6b69
mov eax, dword [ebx + 0x26c]
call fcn.004257d4
test eax, eax
je 0x4d6b69
mov eax, dword [ebx + 0x26c]
call fcn.004257d4
call fcn.0049441c
call fcn.004424c0
mov dx, 8
call fcn.00442488
test al, al
je 0x4d6bb5
mov eax, ebx
call fcn.0044f370
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4d6bc5
push 8
call sub.user32.dll_GetClipboardData
mov edi, eax
mov eax, dword [ebx + 0x26c]
call fcn.004257d4
push eax
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, edi
call fcn.004a5770
call sub.user32.dll_CloseClipboard
cmp byte [ebx + 0x2aa], 0
je 0x4d6bc5
mov eax, ebx
call fcn.004d48f8
pop edi
pop esi
pop ebx
ret
Function at 0x4ecd90
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff8c
mov edi, ecx
mov esi, edx
lea ebx, [esp + 4]
lea eax, [esp + 0x20]
xor ecx, ecx
mov edx, 0x44
call fcn.004032f4
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 0x41
mov word [esp + 0x50], di
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4ece3f
jmp 0x4ece01
cmp dword [ebx + 4], 0x12
jne 0x4ecdf5
mov eax, dword [ebx + 8]
call fcn.00404864
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4ecde7
push esp
mov eax, dword [esp + 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [esp], 0x103
je 0x4ece01
mov eax, dword [esp + 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp + 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
jmp 0x4ece44
call sub.kernel32.dll_GetLastError_1
add esp, 0x74
pop edi
pop esi
pop ebx
ret

Function at 0x4faad4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d2c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4faaee
cmp eax, 0x10
jne 0x4faaf2
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x50258c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
mov eax, dword [eax + 8]
dec eax
jns 0x5025b3
mov eax, dword [ebp - 4]
call fcn.00500dac
xor eax, eax
push ebp
push 0x5026bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov edx, esi
call fcn.00416e10
mov esi, eax
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
call fcn.00416e10
mov ebx, eax
mov eax, dword [esi]
call fcn.0049b080
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebx + 0x48]
call fcn.0049ab14
mov edi, dword [ebx + 0x4c]
cmp dword [edi + 8], 0
je 0x50263d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
mov edx, dword [ebp + 8]
call fcn.004bf7a0
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, edi
call fcn.0049ab14
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
setne byte [ebp - 5]
jmp 0x502675
mov eax, dword [ebp - 4]
call fcn.00508f70
test al, al
je 0x50266a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
mov edx, dword [ebp + 8]
call fcn.004bf7a0
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebx + 0x4c]
call fcn.0049ab14
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
mov byte [ebx + 0x44], al
mov al, byte [esi + 0x20]
mov byte [ebx + 0x42], al
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x3c], eax
mov al, byte [esi + 0x30]
mov byte [ebx + 0x40], al
mov eax, dword [esi + 0x34]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 4]
mov dword [ebx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5026c3
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 1
ret
Function at 0x502944
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
mov eax, dword [eax + 8]
dec eax
jns 0x50296b
mov eax, dword [ebp - 4]
call fcn.00500dac
xor ecx, ecx
push ebp
push 0x502aeb
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
mov edx, ebx
call fcn.00416e10
mov esi, eax
mov eax, 0x40
call fcn.00402774
mov ebx, eax
mov dl, 1
mov eax, dword [0x49a9d0]
call fcn.0049aa54
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 8], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0xc], eax
mov eax, dword [esi]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x48]
call fcn.0049b080
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebx]
call fcn.0049ab14
mov al, byte [esi + 0x42]
mov byte [ebx + 0x20], al
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x2c], eax
mov al, byte [esi + 0x40]
mov byte [ebx + 0x30], al
mov edx, edi
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov ecx, dword [eax + 8]
dec ecx
cmp edx, ecx
jle 0x502a18
mov edx, ebx
call fcn.00416c64
jmp 0x502a1f
mov ecx, ebx
call fcn.00416e8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x502a97
inc eax
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov edx, edi
call fcn.00416e10
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x618]
imul esi, edi
mov eax, dword [ebp - 4]
add esi, dword [eax + 0x61c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
add eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x610]
add ecx, 0xf
mov edx, esi
mov eax, 0xf
call fcn.00415784
push edi
lea esi, [ebp - 0x18]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
inc edi
dec dword [ebp - 8]
jne 0x502a36
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov edx, dword [eax + 8]
dec edx
mov eax, dword [ebp - 4]
imul edx, dword [eax + 0x618]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x61c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
add eax, 0xf
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4bc]
call fcn.0044836c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502af2
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 1
ret
Function at 0x502afc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
mov eax, dword [eax + 8]
dec eax
jns 0x502b20
mov eax, dword [ebp - 4]
call fcn.00500dac
xor eax, eax
push ebp
push 0x502bb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5ec]
mov edx, ebx
call fcn.00416e10
mov ebx, eax
mov edx, esi
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
call fcn.00416e10
mov esi, eax
mov eax, dword [ebx + 0x48]
call fcn.0049b080
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [esi]
call fcn.0049ab14
mov al, byte [ebx + 0x42]
mov byte [esi + 0x20], al
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x2c], eax
mov al, byte [ebx + 0x40]
mov byte [esi + 0x30], al
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [ebx]
mov dword [esi + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502bbc
mov eax, dword [ebp - 4]
mov byte [eax + 0x640], 1
ret

Function at 0x508f70
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebx + 0x634]
cdq
push edx
push eax
mov eax, 0x64
sub eax, dword [esp + 0xc]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x508fa5
cmp eax, dword [esp]
seta al
jmp 0x508fa8
setg al
add esp, 8
add esp, 0x20
pop ebx
ret
Function at 0x402667
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push ebx
mov ecx, dword [ebp + 0xc]
movzx esi, cx
mov eax, esi
mov edi, eax
mov ecx, esi
sub ecx, 1
movzx esi, cx
mov ecx, esi
add ecx, dword [ebp + 0xc]
mov edi, ecx
mov eax, dword [ebp + 8]
or eax, 0xde20
mov edi, eax
mov edx, edi
add edx, esi
add edx, 0x304dce
mov ecx, 0x1068f6
add ecx, edx
mov ebx, ecx
mov edx, esi
add edx, edi
add edx, 0x370584
mov ecx, 0xa1d48
add ecx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
sub ecx, 0xa67bf83c
mov edi, ecx
mov edx, esi
and edx, edi
sub edx, 0x8300
mov eax, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov dword [ebp - 8], eax
mov edx, edi
add edx, 1
mov edi, edx
mov edx, edi
and edx, esi
sub edx, 0x1719
mov dword [ebp - 0xc], edx
mov eax, edi
shr eax, 3
movzx esi, ax
mov edx, esi
imul edx, edi
sub edx, 0x18a4c482
cmp dword [ebp - 0xc], edx
je 0x4027dd
mov ecx, dword [ebp + 0xc]
mov word [ebp - 0x10], cx
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], ax
mov edx, dword [ebp + 0xc]
movzx eax, word [ebp - 0x10]
and edx, eax
mov byte [ebp - 0x18], dl
mov edx, dword [ebp + 8]
sub edx, 0xd5a1
movzx ecx, word [ebp - 0x10]
add edx, ecx
mov word [ebp - 0x14], dx
movzx ecx, byte [ebp - 0x18]
and ecx, 0x80
movzx eax, word [ebp - 0x10]
add eax, ecx
mov dword [ebp - 0x1c], eax
movzx ecx, word [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
add ecx, 0xffffd580
movzx edx, byte [ebx]
mov eax, dword [ebp - 8]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x1c]
xor edx, edx
div dword [ebp - 0x1c]
mov byte [ebp - 0x18], al
movzx eax, byte [ebp - 0x18]
movzx ecx, word [ebp - 0x14]
or eax, ecx
add eax, 0xffff1a34
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 8], ecx
movzx edx, word [ebp - 0x10]
or edx, 0xc6045338
movzx eax, byte [ebp - 0x18]
sub edx, eax
mov word [ebp - 0x14], dx
cmp word [ebp - 0x10], 0xbb4c
jne 0x4027ac
movzx edx, byte [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
add edx, 0xffff44b5
add ebx, edx
mov eax, dword [ebp + 8]
imul eax, eax, 0xb0
mov word [ebp - 0x14], ax
movzx eax, byte [ebp - 0x18]
movzx ecx, word [ebp - 0x10]
and eax, ecx
add eax, 1
mov edx, dword [ebp - 0xc]
sub edx, eax
mov dword [ebp - 0xc], edx
movzx edx, byte [ebp - 0x18]
shr edx, 2
mov byte [ebp - 0x20], dl
jmp 0x4026f4
mov eax, esi
xor eax, edi
sub eax, 0x594bbc83
mov ecx, 0xa1d48
add ecx, eax
mov dword [ebp - 4], ecx
imul edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403ff7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push ebx
mov eax, dword [ebp + 8]
movzx esi, ax
mov eax, esi
shr eax, 3
movzx esi, ax
mov edx, esi
mov edi, edx
mov edx, esi
imul edx, edi
sub edx, 0xffce27ca
mov eax, 0xeae0e
add eax, edx
mov ebx, eax
mov eax, edi
xor edx, edx
div edi
movzx esi, ax
mov ecx, edi
imul ecx, esi
add ecx, 0x389eb2
mov eax, 0xa1d48
add eax, ecx
mov dword [ebp - 4], eax
mov ecx, edi
or ecx, esi
add ecx, esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
or eax, esi
add eax, 0xffffffbf
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0xd
movzx esi, cx
mov eax, edi
sub eax, dword [ebp - 8]
add eax, 0x3091
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
je 0x404115
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 0x18], cl
movzx edx, byte [ebp - 0x18]
shl edx, 8
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 0x18]
shr eax, 2
mov word [ebp - 0x20], ax
movzx eax, byte [ebp - 0x18]
and eax, dword [ebp - 0x1c]
movzx edx, byte [ebx]
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], dl
mov eax, dword [ebp + 0xc]
or eax, 0x358c0000
mov byte [ebp - 0x24], al
mov edx, dword [ebp - 0x1c]
movzx eax, byte [ebp - 0x18]
sub edx, eax
add edx, 0xfffffe03
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
movzx eax, word [ebp - 0x20]
xor edx, eax
or edx, dword [ebp - 0x1c]
mov byte [ebp - 0x18], dl
movzx edx, byte [ebp - 0x18]
and edx, dword [ebp - 0x1c]
add edx, 1
add ebx, edx
mov eax, dword [ebp + 8]
or eax, 0xc400
mov byte [ebp - 0x18], al
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x20]
or ecx, eax
sub ecx, 0x1ff
mov eax, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x404077
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 8]
add eax, 0x389e72
mov ecx, 0xa1d48
add ecx, eax
mov dword [ebp - 4], ecx
mov eax, edi
shl eax, 8
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
movzx esi, cx
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5c946b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005c94ea
jae 0x5c9477
xor ecx, ecx
call fcn.005c94ea
jae 0x5c94a1
xor eax, eax
call fcn.005c94ea
jae 0x5c94b2
mov al, 0x10
call fcn.005c94ea
adc al, al
jae 0x5c9493
jne 0x5c94df
stosb byte es:[edi], al
jmp 0x5c9478
call fcn.005c94f6
dec ecx
loop 0x5c94be
mov eax, ebp
call fcn.005c94f4
jmp 0x5c94e0
lodsb al, byte [esi]
shr eax, 1
je 0x5c9506
adc ecx, 2
mov ebp, eax
jmp 0x5c94e0
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005c94f4
cmp eax, 0x7d00
jae 0x5c94de
cmp eax, 0x500
jae 0x5c94df
cmp eax, 0x7f
ja 0x5c94e0
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5c9478
pop ebp
ret 8
Function at 0x424b50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x424b72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x424b79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424b68
mov eax, 1
add ebx, ebx
jne 0x424b8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x424b9c
jne 0x424bbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424bbb
dec eax
add ebx, ebx
jne 0x424ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x424b80
add ebx, ebx
jne 0x424bb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x424c0d
xor ecx, ecx
sub eax, 3
jb 0x424bd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x424c42
sar eax, 1
mov ebp, eax
jmp 0x424bde
add ebx, ebx
jne 0x424bde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424bac
inc ecx
add ebx, ebx
jne 0x424bec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424bac
add ebx, ebx
jne 0x424bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x424bee
jne 0x424c0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x424bee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x424c2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x424c1e
jmp 0x424b6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x424c2c
add edi, ecx
jmp 0x424b6e
pop esi
mov edi, esi
mov ecx, 0xcc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x424c4a
cmp byte [edi], 6
jne 0x424c4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x424c4f
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x424cbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24f10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24f4c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x424c7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24f50]
or eax, eax
je 0x424cb8
mov dword [ebx], eax
add ebx, 4
jmp 0x424c99
call dword [esi + 0x24f58]
mov ebp, dword [esi + 0x24f54]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x424cf2
sub esp, 0xffffff80
jmp 0x403831