joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015fed
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016164
mov dword [ebp - 0x5c], 0x3eca4f83
mov dword [ebp - 0x58], 0x3eca4f83
mov dword [ebp - 0x54], 0x3eca4f83
mov dword [ebp - 0x50], 0x3eca4f83
mov dword [ebp - 8], 1
mov dword [ebp - 0x28], 0x43ee
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp + ecx - 0x5c], eax
mov dword [ebp - 8], 0xf
jmp 0x1001604d
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffe7
je 0x10016162
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0xc], 0
jmp 0x1001606e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x10016081
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], 0xfffffff8
jmp 0x10016067
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 8]
cmp dword [ebp + eax - 0x4c], ecx
jl 0x100160a5
mov dword [ebp - 0x10], 1
jmp 0x100160a9
and dword [ebp - 0x10], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x5c]
add ecx, dword [ebp - 0x10]
cmp dword [ebp + eax - 0x4c], ecx
jge 0x100160cb
mov dword [ebp - 0x14], 1
jmp 0x100160cf
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jg 0x100160e0
mov dword [ebp - 0x20], 1
jmp 0x100160e4
and dword [ebp - 0x20], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp - 0x34], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x5c]
cmp dword [ebp + eax - 0x5c], ecx
jge 0x1001610f
mov dword [ebp - 0x18], 1
jmp 0x10016113
and dword [ebp - 0x18], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5c]
cmp dword [ebp - 0x18], eax
je 0x1001612b
mov dword [ebp - 0x24], 1
jmp 0x1001612f
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp - 0x3c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov dword [ebp - 0x40], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5c], 0xc31e13ca
jmp 0x10016046
jmp 0x10016181
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10016181
push 0x1ca6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1002784f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002787c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002787a
push 0x1ca6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100278d2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push 0
push 0x58be
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
push dword [ebp - 0x24]
push 0x32ec
call fcn.1002c464
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x100293ba
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002940a
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push dword [ebp - 0x18]
push 0x11e0
push 1
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.10028dc6
add esp, 0x14
jmp 0x1002941c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002941c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x1002efaf
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x199e
push 0x757b
push 1
lea eax, [ebp - 0x10]
push eax
push 0x2b8c
push 0x4c71
push 0x5d76
lea eax, [ebp + 8]
push eax
call fcn.1002ea7f
add esp, 0x20
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002eff8
xor eax, eax
jmp 0x1002f137
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f016
xor eax, eax
jmp 0x1002f137
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1002eb21
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002f035
xor eax, eax
jmp 0x1002f137
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x77be
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002eb8c
add esp, 0x1c
push dword [ebp - 4]
push 0
push dword [ebp + 8]
push 0x5c2a
push 0x72ef
push dword [ebp - 8]
call fcn.1002ad5d
add esp, 0x18
push 0x61a0
lea eax, [ebp - 0x1c]
push eax
push 0x710b
push 0x4964
push 0x19bd
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x692c
call fcn.1002ec1f
add esp, 0x24
lea eax, [ebp - 0x1c]
push eax
push 0x61ae
push 1
lea eax, [ebp - 4]
push eax
push 0x5677
call fcn.1002ef28
add esp, 0x14
push dword [ebp - 4]
call fcn.1002d6bc
pop ecx
test eax, eax
jne 0x1002f0d1
xor eax, eax
jmp 0x1002f137
push dword [ebp - 4]
push 1
call fcn.10027d82
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f11f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002f0fc
xor eax, eax
jmp 0x1002f137
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f115
xor eax, eax
jmp 0x1002f137
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f130
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002f134
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1004534a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080f67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100454be
mov dword [ebp - 0x14], 0xfffffffa
push 2
lea ecx, [ebp - 0x48]
call fcn.100168de
and dword [ebp - 4], 0
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x10], 0
jmp 0x100453a4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100453ba
push dword [ebp - 0x10]
lea ecx, [ebp - 0x48]
call fcn.1001694b
or dword [eax], 0xffffffff
jmp 0x1004539d
mov dword [ebp - 0x10], 0
jmp 0x100453ca
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100453dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0x945cb81e
jmp 0x100453c3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
lea ecx, [ebp - 0x48]
call fcn.1001694b
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
cmp dword [ebp - 0x18], 0
jne 0x10045401
mov dword [ebp - 0x1c], 1
jmp 0x10045405
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x20], eax
je 0x1004541c
mov dword [ebp - 0x24], 1
jmp 0x10045420
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x10045434
cmp dword [ebp - 0x3c], 0
jne 0x10045434
and dword [ebp - 0x28], 0
jmp 0x1004543b
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
je 0x10045455
mov eax, 0xd018
test eax, eax
je 0x10045455
mov dword [ebp - 0x2c], 1
jmp 0x10045459
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0xfffffffd
jae 0x10045468
mov dword [ebp - 0x30], 1
jmp 0x1004546c
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 1
jne 0x10045484
mov eax, 0x39d6
test eax, eax
je 0x10045484
mov dword [ebp - 0x34], 1
jmp 0x10045488
and dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 0xffffffff
je 0x10045497
mov dword [ebp - 0x38], 1
jmp 0x1004549b
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x38]
add eax, ecx
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x54], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10016946
jmp 0x100454c8
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1007b28c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10086330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006b946
mov dword [ebp - 0x14], eax
cmp dword [0x106734c0], esi
jne 0x1007b37f
push 0x800
push esi
push 0x10007afc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007b30c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007b45f
push esi
push esi
push 0x10007afc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007b45f
push 0x10007b14
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b45f
push eax
call ebx
push 0x10007b20
push edi
mov dword [0x106734c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b30
push edi
mov dword [0x106734c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b44
push edi
mov dword [0x106734c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106734d0], eax
test eax, eax
je 0x1007b37c
push 0x10007b60
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106734cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b3a4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007b397
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007b3b9
push 4
pop eax
jmp 0x1007b461
cmp dword [ebp - 0x14], esi
je 0x1007b3b9
push dword [0x106734c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007b39e
mov eax, dword [0x106734cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007b417
cmp dword [0x106734d0], edi
je 0x1007b417
push eax
call ebx
push dword [0x106734d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007b417
test eax, eax
je 0x1007b417
call ecx
test eax, eax
je 0x1007b40c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007b40c
test byte [ebp - 8], 1
jne 0x1007b417
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007b447
mov eax, dword [0x106734c4]
cmp eax, edi
je 0x1007b444
push eax
call ebx
test eax, eax
je 0x1007b444
call eax
mov esi, eax
test esi, esi
je 0x1007b444
mov eax, dword [0x106734c8]
cmp eax, edi
je 0x1007b444
push eax
call ebx
test eax, eax
je 0x1007b444
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106734c0]
call ebx
test eax, eax
je 0x1007b45f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007b461
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x4cb98c
Capabilities:
Encode data using xor

Disassembly:
push edi
push edx
add esp, 0xc
pop ebx
xor esi, ebx
xor eax, esi
call fcn.004cdc01
push 0x456cfb44
mov ecx, 0x4564bd84
pop ebx
xor ecx, ebx
mov esi, section.CODE
mov ebx, 0x40124
xor esi, ebx
xor ecx, esi
mov ebx, 0x3f9a5949
xor ebx, 0x7c69850d
push ebx
push 0x77addf7c
mov edx, 0x345e2731
pop ebx
xor edx, ebx
pop esi
xor edx, esi
mov ebx, 0x2e9b65de
mov edi, 0x2edb75de
jmp 0x4cd888
Function at 0x496403
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x496450
mov al, cl
cmp al, 0x61
jb 0x49642b
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x496450
mov al, cl
cmp al, 0x61
jb 0x496443
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x49641c
cmp edx, dword [esp + 0x18]
je 0x496460
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x496415
xor eax, eax
jmp 0x496463
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x49646b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x496552
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x496558
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4964b7
cmp al, 0x61
jb 0x4964af
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4964a2
cmp edx, dword [esp + 0x14]
je 0x4964c7
dec ecx
jne 0x496497
xor eax, eax
jmp 0x496552
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x496552
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x496552
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x496503
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x496512
jmp 0x4964fa
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00496403
test eax, eax
je 0x496552
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x49654d
cmp al, 0x61
jb 0x496545
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x496538
call fcn.0049646b
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x496570
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x496570
sub edx, ecx
mov ecx, edx
jmp 0x4964c7
xor eax, eax
jmp 0x496552
Function at 0x4f2dc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x127c1f8]
xor edx, edx
cmp eax, edx
jne 0x4f2de6
xor eax, eax
mov byte [eax + 0x127c0f8], al
inc eax
cmp eax, 0x100
jl 0x4f2dce
mov dword [0x127c1f8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x127c0f8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4f2e77
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4f2e4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4f2e18
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4f2e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4f2ed3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4f2eba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f7170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4f7391
cmp eax, 8
jg 0x4f7391
cmp dword [esp + 0x8c], 2
jl 0x4f7391
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4f7391
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4f7391
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4f71f7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4f737a
mov ebp, dword [0x61e6e0]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4f7229
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4f7361
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4f7249
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x61e6cc]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4f7288
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x61e6d4]
lea ecx, [esp + 0x28]
push ecx
call dword [0x61e718]
test eax, eax
jne 0x4f7348
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004f6780
cmp eax, 1
jne 0x4f7372
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004f7030
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4f723d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4f737a
jmp 0x4f7214
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004f6380
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c