joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4188b0
Capabilities:
Delete file

Disassembly:
push 0x48
mov eax, 0x4a9407
call fcn.0048894a
push str._temp.swf
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 1
xor ebx, ebx
call fcn.00401fdd
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00401608
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010a3
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.004013d2
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.004013d2
mov byte [ebp - 4], 1
call fcn.004186dc
pop ecx
pop ecx
cmp al, bl
jne 0x41894e
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010a3
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004010a3
mov al, bl
call fcn.00488a22
ret
lea ecx, [ebp - 0x34]
call fcn.0046f95b
push ebx
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.0046fe5a
test eax, eax
je 0x418a4c
push 0x64
call fcn.00463a96
pop ecx
mov esi, eax
push 0x64
push esi
lea ecx, [ebp - 0x34]
call fcn.0046f64f
test eax, eax
je 0x418a44
push 0x64
push esi
lea ecx, [ebp - 0x54]
call fcn.00418580
lea ecx, [ebp - 0x54]
call fcn.004185be
lea ecx, [ebp - 0x54]
call fcn.004185be
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x54]
call fcn.00418694
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
push ecx
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
push ecx
fstp qword [esp]
call fcn.0048b67f
fdiv qword [0x4b0678]
pop ecx
pop ecx
call fcn.00489850
cmp eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jge 0x4189e1
mov dword [ecx], ebx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
push ecx
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
push ecx
fstp qword [esp]
call fcn.0048b67f
fdiv qword [0x4b0678]
pop ecx
pop ecx
call fcn.00489850
cmp eax, ebx
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
jge 0x418a0f
mov dword [ecx], ebx
lea ecx, [ebp - 0x54]
call fcn.0041859d
movzx eax, ax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
fild dword [ebp - 0x10]
lea ecx, [ebp - 0x54]
fmul qword [0x4b0670]
fstp dword [eax]
call fcn.0041859d
mov ecx, dword [ebp + 0x14]
movzx eax, ax
push esi
mov dword [ecx], eax
call fcn.00463a8b
pop ecx
mov bl, 1
lea ecx, [ebp - 0x34]
call fcn.0046f8f5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0046fa63
jmp 0x418930

Function at 0x418a66
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004899b0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
dec eax
neg eax
sbb al, al
inc al
leave
ret
Function at 0x418ac6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004899b0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x44], eax
call fcn.0046d782
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, 1
jne 0x418b73
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x418b61
cmp dword [ebp - 0x18], 0x113
je 0x418b50
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x418b6e
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
jne 0x418b33
mov al, 1
pop edi
jmp 0x418b75
xor al, al
pop esi
leave
ret

Function at 0x418cba
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4f1a20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, str.system.ini
push ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x4ac85f
mov edi, str.SCRNSAVE.EXE
push edi
mov esi, 0x4b0690
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
push 0
push 1
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010a3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048893b
leave
ret

Function at 0x418d9d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418dd6
xor esi, esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010a3
mov eax, esi
pop esi
leave
ret
push edi
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
fld qword [0x4acfa0]
push 0x20
push ecx
push ecx
fstp qword [esp]
call fcn.00402f11
add esp, 0xc
call fcn.00489850
mov esi, eax
imul esi, dword [ebp - 4]
add esi, edi
pop edi
jmp 0x418dc6
Function at 0x418e10
Capabilities:
Write file on windows

Disassembly:
push 0x14
mov eax, 0x4a9432
call fcn.0048894a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0047628c
push dword [ebp + 0xc]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004763c5
cmp dword [ebp - 0x18], 0
jle 0x418e89
push 0x4af82c
push dword [ebp + 8]
call fcn.0048aa51
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x418e89
push esi
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0048a90b
push esi
call fcn.0048a72d
add esp, 0x14
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.004762a3
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010a3
mov al, bl
call fcn.00488a22
ret
xor bl, bl
jmp 0x418e6a

Function at 0x418e8d
Capabilities:
Read file on windows

Disassembly:
push 0x18
mov eax, 0x4a945d
call fcn.0048894a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
xor bl, bl
call fcn.0047628c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.004013d2
call fcn.00418d2d
pop ecx
test al, al
je 0x418f13
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.004013d2
call fcn.00418d9d
mov dword [esp], 0x4b0220
push dword [ebp + 8]
mov edi, eax
call fcn.0048aa51
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x418f13
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x24]
call fcn.004762b3
push esi
push 1
push edi
push dword [ebp - 0x20]
call fcn.0048b2b5
push esi
call fcn.0048a72d
add esp, 0x14
inc bl
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
call fcn.004763c5
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.004762a3
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010a3
mov al, bl
call fcn.00488a22
ret
Function at 0x419403
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x4f1a20]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x1c
mov eax, 0x4a9552
call fcn.0048894a
mov edi, dword [ebp + 0x134]
xor ebx, ebx
push str.IFViewer
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.00401aa9
mov esi, eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], ebx
call fcn.004193ab
push esi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0040168d
add esp, 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004010a3
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010a3
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.004013d2
call fcn.00418d65
pop ecx
cmp al, bl
jne 0x41949c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
call fcn.0047a157
test eax, eax
je 0x4194da
test byte [ebp + 0x20], 2
jne 0x4194da
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
mov byte [ebp + 0x20], 2
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
call fcn.0047a371
mov eax, dword [0x4f51c8]
mov eax, dword [eax - 0xc]
mov esi, 0x4f51c8
cmp eax, ebx
jne 0x41959e
call fcn.00464f86
push eax
lea ecx, [ebp - 0x14]
call fcn.00401275
mov byte [ebp - 4], 5
call fcn.0048a3f5
push eax
call fcn.0048a3f5
push eax
lea eax, [ebp - 0x14]
push str._d_d
push eax
call fcn.0040167a
add esp, 0x10
push 0x4acfb0
lea ecx, [ebp - 0x18]
call fcn.00401aa9
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 6
call fcn.0040168d
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 7
call fcn.0040168d
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.00401608
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010a3
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004010a3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.004010a3
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00401608
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004010a3
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push esi
call fcn.004013d2
call fcn.00418d65
pop ecx
cmp al, bl
jne 0x4195c1
push ebx
push dword [0x4f51c8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
mov ecx, edi
call fcn.004013d2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010a3
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.0048893b
add ebp, 0x12c
leave
ret
Function at 0x419cf8
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f1a20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 0x26
lea ecx, [ebp - 0x108]
push ecx
push eax
mov dword [ebp - 0x10c], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, esi
test eax, eax
jl 0x419d3c
lea eax, [ebp - 0x108]
push eax
call fcn.00401aa9
jmp 0x419d41
call fcn.004013be
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048893b
leave
ret

Function at 0x41a069
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x4a97b6
call fcn.0048894a
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push str.Scratch
lea ecx, [ebp - 0x18]
call fcn.00401aa9
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x14]
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00419403
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov byte [ebp - 4], 2
call fcn.0040168d
add esp, 0x10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x10], esi
call fcn.004010a3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010a3
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edi
call fcn.004013d2
call fcn.00418d65
pop ecx
test al, al
jne 0x41a0eb
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, edi
call fcn.00488a22
ret

Function at 0x41a0f3
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x4a97b6
call fcn.0048894a
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push str.Workspace
lea ecx, [ebp - 0x18]
call fcn.00401aa9
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x14]
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00419403
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov byte [ebp - 4], 2
call fcn.0040168d
add esp, 0x10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x10], esi
call fcn.004010a3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010a3
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edi
call fcn.004013d2
call fcn.00418d65
pop ecx
test al, al
jne 0x41a175
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, edi
call fcn.00488a22
ret

Function at 0x41a3f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
jne 0x41a3fa
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call fcn.0048b2b5
add esp, 0x10
ret 0xc

Function at 0x41a420
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
jne 0x41a42a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call fcn.0048a90b
add esp, 0x10
ret 0xc
Function at 0x41ede0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4a9a08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f1a20]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x48]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x41ee8b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x41ee9b
mov ebp, vtable.CxMemFile.0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esp + 0x40], ebx
call sym.Player.exe_public:_bool___thiscall_CxImage::Decode_class_CxFile___unsigned_long_int_
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ebp
cmp eax, ebx
je 0x41ee85
cmp byte [esp + 0x24], bl
je 0x41ee85
push eax
call fcn.0048a1af
add esp, 4
mov al, byte [esp + 0x40]
jmp 0x41ee9d
add edi, 0x44
mov ecx, 6
mov esi, str.Unable_to_load_resource_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0xc

Function at 0x41f120
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push 0x4af82c
push ebp
mov edi, ecx
call fcn.0048aa51
mov esi, eax
add esp, 8
test esi, esi
jne 0x41f145
pop edi
pop esi
xor al, al
pop ebp
ret 8
mov eax, dword [esp + 0x14]
push ebx
push eax
push esi
mov ecx, edi
call sym.Player.exe_public:_bool___thiscall_CxImage::Encode_struct__iobuf___unsigned_long_int_
push esi
mov bl, al
call fcn.0048a72d
add esp, 4
test bl, bl
jne 0x41f169
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x427090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xf93c], eax
mov dword [esi + 0xf938], ecx
mov dword [esi + 0xf92c], ecx
mov edx, 1
shl edx, cl
dec ecx
mov eax, 1
shl eax, cl
push edi
xor edi, edi
dec edx
mov dword [esi + 0xf940], eax
inc eax
mov dword [esi + 0xf944], eax
mov ax, word [esi + 0xf940]
add ax, 2
mov ecx, esi
mov dword [esi + 0xf934], edi
mov dword [esi + 0x2b0], edi
mov dword [esi + 0x2ac], edi
mov word [esi + 0xf930], dx
mov word [esi + 0xf932], ax
mov dword [esi + 0xf948], edi
call fcn.00425d40
mov ebp, eax
xor ecx, ecx
mov eax, 0x138b
nop
add eax, eax
inc ecx
cmp eax, 0x10000
jl 0x427110
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.00425de0
movzx ecx, word [esi + 0xf940]
push ecx
mov ecx, esi
call fcn.00426ef0
cmp ebp, 0xffffffff
je 0x42724a
push ebx
lea ebx, [ebx]
mov ecx, esi
call fcn.00425d40
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x427249
mov ecx, dword [esp + 0x14]
movsx edi, ax
shl edi, cl
mov ebx, eax
shl ebx, 0xc
add ebx, ebp
xor edi, ebp
mov ecx, dword [esi + edi*4 + 0x83e8]
lea eax, [esi + edi*4 + 0x83e8]
cmp ecx, ebx
jne 0x427195
movzx ebp, word [esi + edi*2 + 0xd214]
jmp 0x427240
test ecx, ecx
jl 0x4271d4
mov ecx, 0x138b
sub ecx, edi
test edi, edi
jne 0x4271b0
mov ecx, 1
lea esp, [esp]
lea edx, [ecx*4]
sub edi, ecx
sub eax, edx
test edi, edi
jge 0x4271ca
add edi, 0x138b
add eax, 0x4e2c
mov edx, dword [eax]
cmp edx, ebx
je 0x427188
test edx, edx
jg 0x4271b0
push ebp
mov ecx, esi
call fcn.00426ef0
movzx eax, word [esi + 0xf932]
mov ebp, dword [esp + 0x18]
mov edx, 0x1000
cmp ax, dx
jge 0x427209
mov word [esi + edi*2 + 0xd214], ax
inc word [esi + 0xf932]
mov dword [esi + edi*4 + 0x83e8], ebx
jmp 0x427240
push 0x138b
mov ecx, esi
call fcn.00425de0
movzx ecx, word [esi + 0xf940]
mov ax, word [esi + 0xf940]
add ax, 2
push ecx
mov ecx, esi
mov word [esi + 0xf932], ax
mov dword [esi + 0xf934], 1
call fcn.00426ef0
cmp ebp, 0xffffffff
jne 0x427150
pop ebx
push ebp
mov ecx, esi
call fcn.00426ef0
movzx edx, word [esi + 0xf944]
push edx
mov ecx, esi
call fcn.00426ef0
pop edi
pop esi
pop ebp
ret 8
Function at 0x42a640
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x42a680
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4f51cc]
test eax, eax
jle 0x42a694
inc eax
mov dword [0x4f51cc], eax
jmp 0x42a761
push str.QuickTime.qts
call fcn.0042a830
add esp, 4
mov dword [0x4f51d0], eax
test eax, eax
jne 0x42a6b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x42a729
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._CallComponentFunctionWithStorage
push eax
call esi
test eax, eax
mov dword [0x4ee888], eax
je 0x42a724
mov edx, dword [0x4f51d0]
push str._CallComponent
push edx
call esi
test eax, eax
mov dword [0x4ee884], eax
je 0x42a724
mov eax, dword [0x4f51d0]
push str.theQuickTimeDispatcher
push eax
call esi
test eax, eax
mov dword [0x4ee880], eax
je 0x42a724
mov ecx, dword [esp + 0x10c]
mov dword [0x4ee87c], 0
push ecx
call fcn.0042a580
mov esi, eax
add esp, 4
test si, si
jne 0x42a729
inc dword [0x4f51cc]
jmp 0x42a761
mov esi, 0xfffff7d2
mov eax, dword [0x4f51d0]
test eax, eax
je 0x42a743
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4f51d0], 0
mov eax, 0x42a590
mov dword [0x4ee87c], 0x42a780
mov dword [0x4ee884], eax
mov dword [0x4ee888], eax
mov dword [0x4ee880], eax
test edi, edi
je 0x42a773
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, si
pop edi
pop esi
add esp, 0x100
ret
Function at 0x42d0b0
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x42d0ca
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x42d1da
push ebp
jmp 0x42d0e0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x42d0ef
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x42d19b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x42d110
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x42d110
test eax, eax
je 0x42d1ad
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x42d1a0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x42d0e0
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x446db0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x446f5a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x446e08
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x446e1b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x446e2f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x446e76.3
jmp 0x446e40
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x446e4c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x446e51
mov esi, 1
inc eax
cmp eax, edi
jl 0x446e40
cmp si, cx
je case.0x446e76.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x446e76.3
movzx eax, byte [eax + 0x446f74]
jmp dword [eax*4 + 0x446f60]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x446e76.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x446e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x446e76.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x446ed0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x446e76.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x446ef6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x446e76.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x446f20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret