joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0x40
mov dword [ebp - 0x50], eax
mov esi, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], edx
push 0
push eax
call fcn.004d6720
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x48], 0
test eax, eax
jne 0x4296b1
xor al, al
jmp 0x4296b4
mov al, byte [eax + 8]
movzx ecx, al
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
test eax, eax
je 0x4297a1
push edi
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x429721
push dword [ebx + 4]
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebx]
add esp, 4
test eax, eax
je 0x429721
push dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x50]
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x429721
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x48]
push 4
push ecx
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x429721
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push dword [ebx + 4]
call eax
add esp, 8
xor ecx, ecx
test edi, edi
je 0x42978c
cmp edi, 0x20
jb 0x42977b
lea edx, [esi - 1]
lea eax, [ebp + edi - 0x45]
add edx, edi
cmp esi, eax
ja 0x429740
lea eax, [ebp - 0x44]
cmp edx, eax
jae 0x42977b
mov eax, edi
mov edx, edi
and eax, 0x1f
sub edx, eax
lea eax, [ebp - 0x34]
nop dword [eax]
movups xmm0, xmmword [esi]
add ecx, 0x20
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
add esi, 0x20
cmp ecx, edx
jb 0x429750
cmp ecx, edi
jae 0x42978c
nop
mov al, byte [ebp + ecx - 0x44]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x429780
mov eax, dword [ebp - 0x4c]
inc byte [ebp - 0x45]
sub eax, edi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
jne 0x4296c6
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x42b1c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x42b35b
mov edi, dword [ebp + 0xc]
xor edx, edx
cmp eax, esi
jae 0x42b1fe
nop dword [eax]
cmp byte [eax + edi], 0x20
jne 0x42b1fc
inc eax
inc edx
cmp eax, esi
jb 0x42b1f0
cmp eax, esi
je 0x42b272
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jb 0x42b216
cmp byte [eax + edi], 0xd
jne 0x42b216
cmp byte [eax + edi + 1], 0xa
je 0x42b266
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x42b266
test edx, edx
jne 0x42b33e
cmp cl, 0x3d
jne 0x42b235
inc ebx
cmp ebx, 2
ja 0x42b33e
cmp cl, 0x7f
ja 0x42b33e
movzx ecx, cl
mov cl, byte [ecx + 0x524118]
cmp cl, 0x7f
je 0x42b33e
cmp cl, 0x40
jae 0x42b25d
test ebx, ebx
jne 0x42b33e
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
jmp 0x42b269
mov ecx, dword [ebp - 4]
inc eax
cmp eax, esi
jb 0x42b1e6
test ecx, ecx
je 0x42b35b
and ecx, 7
lea ecx, [ecx + ecx*2]
lea edx, [ecx*2 + 7]
mov ecx, dword [ebp - 4]
shr ecx, 3
shr edx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*2]
mov edx, dword [ebp - 8]
sub ecx, ebx
test edx, edx
je 0x42b34a
cmp dword [ebp - 0xc], ecx
jb 0x42b34a
xor ecx, ecx
mov dword [ebp - 4], 3
xor ebx, ebx
mov dword [ebp + 0x10], ecx
mov esi, edx
test eax, eax
je 0x42b32e
mov cl, byte [edi]
cmp cl, 0xd
je 0x42b325
cmp cl, 0xa
je 0x42b325
cmp cl, 0x20
je 0x42b325
movzx ecx, cl
mov dl, byte [ecx + 0x524118]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp + 0x10]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0x10], edx
cmp edx, 4
jne 0x42b325
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp + 0x10], ecx
test edx, edx
je 0x42b310
mov ecx, ebx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp edx, 1
jbe 0x42b31d
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp edx, 2
jbe 0x42b325
mov byte [esi], bl
inc esi
inc edi
sub eax, 1
jne 0x42b2c0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
sub esi, edx
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffd4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x5263dc]
mov ebx, ecx
push edi
mov edi, 0x5263d8
test esi, esi
je 0x43004c
mov ecx, dword [ebp + 0xc]
nop word [eax + eax]
mov eax, dword [esi + 0x1c]
cmp dword [eax], edx
jne 0x430042
cmp dword [esi + 8], ecx
jne 0x430042
cmp dword [esi + 4], 1
je 0x430056
mov esi, dword [edi + 0xc]
add edi, 8
test esi, esi
jne 0x430030
mov eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret
mov esi, dword [edi + 4]
test esi, esi
je 0x43004c
cmp dword [esi + 0x18], 0x10
jne 0x43004c
test ebx, ebx
je 0x43008e
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x43007c
mov eax, dword [ebx]
push ecx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
call eax
add esp, 4
mov eax, 0x40
mov ecx, ebx
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x430083
mov edx, esi
mov ecx, ebx
call fcn.004176b0
test eax, eax
jne 0x430051
mov edx, dword [ebp + 8]
mov ecx, ebx
push 1
push dword [ebp + 0xc]
call fcn.00417700
add esp, 8
test eax, eax
jne 0x430051
pop edi
pop esi
mov ecx, ebx
pop ebx
pop ebp
jmp fcn.0042fdc0
Function at 0x4302c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0
movups xmmword [esi + 0x160], xmm0
push edi
lea edi, [esi + 0x160]
mov dword [ebp - 0x18], esi
movups xmmword [esi + 0x170], xmm0
mov dword [esi + 0x180], edx
lea eax, [esi + 0x170]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
cmp edx, 0xc
jne 0x430352
movq xmm0, qword [ebx]
movq qword [edi], xmm0
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov byte [esi + 0x16f], 1
jmp 0x430405
lea ecx, [edx*8]
mov eax, ecx
shr eax, 0x18
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 7], al
mov al, dl
shr ecx, 8
shl al, 3
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
test edx, edx
je 0x4303ba
nop
mov esi, 0x10
cmp edx, esi
cmovb esi, edx
xor ecx, ecx
test esi, esi
je 0x43039b
mov al, byte [ecx + ebx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x430390
mov ecx, dword [ebp - 0x18]
mov edx, edi
push edi
call fcn.004300c0
mov edx, dword [ebp + 0xc]
add esp, 4
sub edx, esi
add ebx, esi
mov dword [ebp + 0xc], edx
test edx, edx
jne 0x430380
mov esi, dword [ebp - 0x18]
xor ecx, ecx
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x14]
xor byte [esi + ecx + 0x160], al
movzx eax, byte [ebp + ecx - 0x13]
xor byte [esi + ecx + 0x161], al
movzx eax, byte [ebp + ecx - 0x12]
xor byte [esi + ecx + 0x162], al
movzx eax, byte [ebp + ecx - 0x11]
xor byte [esi + ecx + 0x163], al
add ecx, 4
cmp ecx, 0x10
jb 0x4303c0
push edi
mov edx, edi
mov ecx, esi
call fcn.004300c0
add esp, 4
lea eax, [ebp - 0x20]
mov edx, edi
push eax
lea eax, [esi + 0x150]
mov ecx, esi
push eax
push 0x10
call fcn.00417780
add esp, 0xc
test eax, eax
jne 0x430472
mov edi, dword [ebp + 0x10]
mov ebx, 0xd
mov dword [esi + 0x148], 0xd
mov dword [esi + 0x14c], eax
nop word [eax + eax]
mov edx, dword [ebp - 0x1c]
mov esi, 0x10
cmp ebx, esi
cmovb esi, ebx
xor eax, eax
test esi, esi
je 0x43045e
mov cl, byte [eax + edi]
xor byte [edx + eax], cl
inc eax
cmp eax, esi
jb 0x430453
mov ecx, dword [ebp - 0x18]
push edx
call fcn.004300c0
add esp, 4
add edi, esi
sub ebx, esi
jne 0x430440
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x430630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], edx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx + 0x140]
mov eax, dword [ebx + 0x144]
mov esi, dword [ebx + 0x14c]
shld eax, ecx, 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x148]
shld esi, eax, 3
shl ecx, 3
shl eax, 3
mov dword [ebp - 0x18], eax
lea eax, [edi - 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], esi
cmp eax, 0xc
ja 0x4307c2
push edi
lea eax, [ebx + 0x150]
push eax
push edx
call fcn.004d61a0
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov edx, dword [ebp - 0x20]
or eax, edx
mov ecx, dword [ebp - 0x18]
jne 0x4306b4
mov eax, ecx
or eax, esi
je 0x4307af
mov eax, esi
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, esi
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, esi
shr eax, 8
mov byte [ebp - 0x12], al
movzx eax, byte [ebp - 0x2c]
mov byte [ebp - 0x11], al
mov eax, esi
shrd ecx, eax, 0x18
shr eax, 0x18
mov byte [ebp - 0x10], cl
mov eax, esi
mov ecx, dword [ebp - 0x18]
shrd ecx, eax, 0x10
shr eax, 0x10
mov byte [ebp - 0xf], cl
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shrd eax, esi, 8
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xe], al
mov eax, edx
mov ecx, dword [ebp - 0x1c]
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x34]
mov byte [ebp - 9], al
mov eax, edx
shrd ecx, eax, 0x18
shr esi, 8
shr eax, 0x18
mov byte [ebp - 8], cl
mov eax, edx
mov ecx, dword [ebp - 0x1c]
shrd ecx, eax, 0x10
shr eax, 0x10
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shrd eax, edx, 8
mov byte [ebp - 5], cl
shr edx, 8
mov byte [ebp - 6], al
xor eax, eax
movzx ecx, byte [ebp + eax - 0x14]
xor byte [ebx + eax + 0x170], cl
movzx ecx, byte [ebp + eax - 0x13]
xor byte [ebx + eax + 0x171], cl
movzx ecx, byte [ebp + eax - 0x12]
mov dl, byte [ebp + eax - 0x11]
xor byte [ebx + eax + 0x172], cl
xor byte [ebx + eax + 0x173], dl
add eax, 4
cmp eax, 0x10
jb 0x430751
lea esi, [ebx + 0x170]
mov ecx, ebx
push esi
mov edx, esi
call fcn.004300c0
add esp, 4
xor ecx, ecx
test edi, edi
je 0x4307af
mov edx, dword [ebp - 0x24]
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x4307a4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x4307e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x24]
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov esi, edx
mov edx, dword [ebp + 0x20]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
xor edx, edx
push ecx
mov ecx, ebx
mov dword [ebp - 0x1c], edi
call fcn.004302c0
add esp, 0x10
test eax, eax
jne 0x4308a4
push edi
push dword [ebp - 0x18]
mov edx, esi
mov ecx, ebx
call fcn.00430490
add esp, 8
test eax, eax
jne 0x4308a4
push dword [ebp + 0x1c]
lea edx, [ebp - 0x14]
mov ecx, ebx
call fcn.00430630
add esp, 4
test eax, eax
jne 0x4308a4
xor edx, edx
xor ebx, ebx
cmp dword [ebp + 0x1c], edx
jbe 0x4308a2
mov edi, dword [ebp + 0x18]
lea eax, [ebp - 0x14]
sub edi, eax
nop dword [eax]
lea eax, [ebp - 0x14]
add eax, edx
inc edx
movzx ecx, byte [edi + eax]
movzx eax, byte [eax]
xor ecx, eax
or ebx, ecx
cmp edx, dword [ebp + 0x1c]
jb 0x430860
mov edi, dword [ebp - 0x1c]
test ebx, ebx
je 0x4308a2
test esi, esi
je 0x43088c
mov byte [edi], 0
lea edi, [edi + 1]
sub esi, 1
jne 0x430881
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret
Function at 0x430d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
push dword [ebp + 0x24]
mov edi, dword [ebp + 8]
mov esi, edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ebx
lea ebx, [ebp - 0x14]
push ebx
mov ebx, dword [ebp - 0x18]
push ebx
push eax
push ecx
push edx
push dword [ebp + 0xc]
mov edx, 1
push edi
push esi
call fcn.00430970
add esp, 0x24
test eax, eax
jne 0x430dd9
xor edi, edi
xor dl, dl
cmp dword [ebp + 0x24], edi
jbe 0x430dd7
mov ebx, dword [ebp + 0x20]
movzx ecx, byte [eax + ebx]
inc dl
movzx eax, byte [ebp + eax - 0x14]
xor ecx, eax
movzx eax, dl
or edi, ecx
cmp eax, dword [ebp + 0x24]
jb 0x430d94
mov ebx, dword [ebp - 0x18]
test edi, edi
je 0x430dd7
test esi, esi
je 0x430dc1
mov byte [ebx], 0
lea ebx, [ebx + 1]
sub esi, 1
jne 0x430db6
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d219c
mov esp, ebp
pop ebp
ret

Function at 0x432520
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi]
lea ecx, [esi + 8]
mov ebx, dword [esi + 4]
mov dword [ebp - 4], ecx
test edx, edx
je 0x432586
mov edx, dword [ebp + 0xc]
sub dword [ebp + 8], edx
mov esi, dword [ebp - 4]
lea eax, [edi + 1]
movzx edi, al
lea edx, [edx + 1]
movzx ecx, byte [ecx + edi]
lea eax, [ecx + ebx]
movzx ebx, al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov byte [esi + edi], al
mov byte [esi + ebx], cl
add cl, al
movzx eax, cl
mov ecx, esi
mov esi, dword [ebp + 8]
mov al, byte [eax + ecx]
xor al, byte [esi + edx - 1]
sub dword [ebp - 8], 1
mov byte [edx - 1], al
jne 0x432546
mov esi, dword [ebp - 0xc]
mov dword [esi], edi
xor eax, eax
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434190
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
xor ecx, dword [edx + 4]
mov eax, ecx
xor ebx, dword [edx]
shr eax, 0x10
movzx eax, al
push esi
movzx esi, byte [eax + 0x527420]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + 0x527270]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x526e18]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x527000]
or esi, eax
mov eax, ebx
shr eax, 0x10
mov edx, esi
movzx eax, al
rol edx, 8
movzx ecx, byte [eax + 0x527270]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x527000]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x527420]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x526e18]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x4354e0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
lea eax, [ecx - 0x20]
cmp eax, 0x1a0
ja 0x435608
test cl, 7
jne 0x435608
push esi
shr ecx, 3
mov esi, 0x527768
push edi
mov dword [ebp + 8], ecx
lea edi, [ebx + 0x48]
mov ecx, 0x400
mov dword [ebp - 4], ebx
rep movsd dword es:[edi], dword [esi]
mov eax, 0x527720
mov dword [ebp - 8], 0x12
xor esi, esi
mov edi, edx
sub eax, ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, byte [esi + edi]
inc esi
cmp esi, ebx
sbb ecx, ecx
shl eax, 8
and ecx, esi
movzx edx, byte [ecx + edi]
inc ecx
or edx, eax
cmp ecx, ebx
sbb eax, eax
shl edx, 8
and eax, ecx
movzx esi, byte [eax + edi]
inc eax
or esi, edx
cmp eax, ebx
sbb ecx, ecx
shl esi, 8
and ecx, eax
mov eax, dword [ebp - 0x10]
movzx edx, byte [ecx + edi]
inc ecx
or edx, esi
cmp ecx, ebx
sbb esi, esi
and esi, ecx
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx]
xor eax, edx
mov dword [ecx], eax
add ecx, 4
sub dword [ebp - 8], 1
mov dword [ebp - 4], ecx
jne 0x435538
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
nop
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp + 8]
call fcn.004353c0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 4]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jb 0x4355a0
lea esi, [ebx + 0x4c]
mov dword [ebp - 8], 4
mov edi, 0x80
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp + 8]
call fcn.004353c0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x4355d5
sub dword [ebp - 8], 1
jne 0x4355d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ca00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 3
cmp dword [ebp + 8], ecx
jae 0x44ca21
mov dword [ebp - 4], 1
jmp 0x44ca28
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x44ca7f
mov edx, dword [ebp + 0xc]
push edx
call fcn.0044d670
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.0044d670
add esp, 4
xor esi, eax
mov dword [ebp - 8], esi
jne 0x44ca63
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [ebp + 0xc], edx
jmp 0x44ca0d
mov eax, dword [ebp - 8]
push eax
call fcn.0044bf20
add esp, 4
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0xc]
jmp 0x44cafb
xor ecx, ecx
je 0x44ca95
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp + 8], ecx
jae 0x44cad4
mov edx, dword [ebp + 0xc]
push edx
call fcn.0044d600
add esp, 4
movzx esi, ax
mov eax, dword [ebp + 8]
push eax
call fcn.0044d600
add esp, 4
movzx ecx, ax
cmp esi, ecx
jne 0x44cad4
mov edx, dword [ebp + 8]
add edx, 2
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 2
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x10]
jae 0x44caf5
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x44caf5
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44e8c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
jne 0x44e942
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
je 0x44e942
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
jne 0x44e942
xor eax, eax
jmp 0x44e94a
mov ecx, dword [ebp - 4]
call fcn.0044f570
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x44eb10
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7510
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x541a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44eb4b
xor eax, eax
jmp 0x44ec14
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44ec0f
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44ec0f
push 1
lea ecx, [ebp - 0x38]
call fcn.0044da40
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00450ea0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44ebb8
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.00450280
lea ecx, [ebp - 0x38]
call fcn.0044e880
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x10]
call fcn.0044dc60
mov byte [ebp - 4], 1
push 0x504bcc
lea ecx, [ebp - 0x10]
call fcn.0044e2e0
lea ecx, [ebp - 0x10]
call fcn.004432f0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0044dfa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0044dea0
mov eax, dword [ebp - 0x18]
jmp 0x44ec14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44f2e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x28], ecx
push 0x1c
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x44f304
xor eax, eax
jmp 0x44f3e2
mov edx, dword [ebp - 0x40]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44f327
xor eax, eax
jmp 0x44f3e2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
jmp 0x44f36e
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0xc], edx
jae 0x44f3e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 8]
jbe 0x44f39c
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], eax
jmp 0x44f3a5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jb 0x44f3db
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x24]
ja 0x44f3db
mov eax, dword [ebp - 0xc]
add eax, 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov eax, 1
jmp 0x44f3e2
jmp 0x44f35c
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14