joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4230f0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423237
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x423187
push 9
push str.Software_
jmp 0x42318e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push str.2345Pinyin
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x4231fb
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push str.Value4
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423216
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423143
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x423260
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x4232ea
push 9
push str.Software_
jmp 0x4232f1
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push str.2345Mobile
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x42335e
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push str.Value4
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423379
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x4232a6
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x4233c0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423507
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x423457
push 9
push str.Software_
jmp 0x42345e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push str.2345PCSafe
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x4234cb
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push str.Value4
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4234e6
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423413
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x423530
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423677
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x4235c7
push 9
push str.Software_
jmp 0x4235ce
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 6
push 0x5a9b6c
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x42363b
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push str.Value4
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423656
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423583
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x42cb80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [edx + 0x14], 8
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
jb 0x42cba8
mov edx, dword [edx]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42cc27
mov eax, dword [esp + 8]
test eax, eax
je 0x42cc27
push ebx
xor bl, bl
mov dword [esp + 0x14], 4
cmp dword [esi + 0x14], 8
mov dword [esp + 0x10], 4
jb 0x42cbe7
mov esi, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00564de8
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00564de8
add esp, 0x10
ret

Function at 0x42cc40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp byte [esp + 0x220], 0
mov eax, 0x20019
push ebp
mov ebp, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, 0x20119
mov dword [esp + 0xc], 0
cmovne eax, edi
cmp dword [edx + 0x14], 8
jb 0x42cc8a
mov edx, dword [edx]
lea edi, [esp + 0xc]
push edi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42cd31
mov edi, dword [esp + 0xc]
test edi, edi
je 0x42cd31
push ebx
push 0x206
push eax
mov word [esp + 0x24], ax
xor bl, bl
lea eax, [esp + 0x26]
push eax
call fcn.0056cbb0
add esp, 0xc
mov dword [esp + 0x18], 1
cmp dword [esi + 0x14], 8
mov dword [esp + 0x14], 0x208
jb 0x42cce1
mov esi, dword [esi]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42cd0c
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.0040bc40
mov bl, 1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00564de8
add esp, 0x218
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x220]
xor al, al
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00564de8
add esp, 0x218
ret
Function at 0x42dd30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x588b88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00404960
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov al, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42dfd0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58b6d6
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x3f8]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
xor bl, bl
push 0x5ac964
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
test esi, esi
je 0x42e047
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x42e064
push 0x10
push 0x5ac964
push 0x5ac980
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42e122
push 0x4cd210
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x3d8
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0042d950
mov dword [esp + 0x400], 0
test edi, edi
mov edx, 0x5a87c4
cmovne edx, edi
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x28], esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [edx], ax
jne 0x42e0c6
xor ecx, ecx
jmp 0x42e0df
mov ecx, edx
lea edi, [ecx + 2]
jmp 0x42e0d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e0d0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00404a80
mov byte [esp + 0x418], 1
mov byte [esp + 0x418], 0
lea ecx, [esp + 0x2c]
call fcn.0042de70
push ecx
call fcn.004c3cc0
mov ecx, eax
call fcn.004c5420
mov dword [esp + 0x400], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0042ddd0
xor eax, eax
mov ecx, dword [esp + 0x3f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x434acd
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x434ab0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x434b40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
mov ecx, 0x80
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebp]
jne 0x434b6e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x7e1750]
test eax, eax
je 0x434b79
call eax
lea eax, [esi*8]
push eax
call fcn.00430eb0
mov ecx, dword [0x7e1754]
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x434b9b
call ecx
test ebx, ebx
je 0x434b64
push dword [ebp + 0xc]
call fcn.004311a0
add esp, 4
mov dword [ebp + 0xc], ebx
push ebx
call dword [0x5e3f6c]
shr eax, 3
add esp, 4
mov dword [esp + 0x14], eax
mov dword [ebp], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.0056cbb0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp + 8], 0
test ecx, ecx
je 0x434c7c
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x434c0f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x5ad690]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x434bf2
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [eax + edx*8]
test esi, esi
je 0x434c59
mov eax, dword [esi]
test eax, eax
je 0x434c2f
mov edx, dword [esi + 4]
jmp 0x434c31
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x434c59
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x434c51
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x434c72
mov dword [ebp + 8], ecx
mov dword [edx + 4], ecx
jmp 0x434c72
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x434c68
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [ebp + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x434be6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x434da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ecx + 0xc], 0
mov eax, edx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
je 0x434df5
push ebx
push esi
xor esi, esi
mov ebx, eax
push edi
mov edi, ebp
test ebp, ebp
jle 0x434de6
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x434dc5
mov ecx, dword [esp + 0x10]
mov eax, esi
xor edx, edx
div dword [ecx]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
jmp 0x434df7
xor edx, edx
push edx
push ebp
mov edx, eax
call fcn.00434c90
add esp, 8
pop ebp
test eax, eax
je 0x434e0f
mov eax, dword [eax + 8]
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x434e20
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x10], edi
cmp dword [esi], 0
je 0x434e6c
mov eax, dword [esp + 0x18]
mov ebp, edi
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x434e5e
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x434e40
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [esp + 0x10]
mov ebp, edx
jmp 0x434e6e
xor ebp, ebp
push ebp
push dword [esp + 0x1c]
mov edx, edi
mov ecx, esi
call fcn.00434c90
add esp, 8
test eax, eax
je 0x434eb1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x434ea3
push ebp
mov edx, eax
mov ecx, esi
call fcn.00434d40
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x434f47
push 0x14
call fcn.00430eb0
mov edi, eax
add esp, 4
test edi, edi
je 0x434ea9
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x434f11
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x434f11
add edx, edx
mov ecx, esi
call fcn.00434b40
test eax, eax
je 0x434f11
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
call fcn.00434aa0
xor edx, edx
div dword [esi]
mov ebp, edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x434f2e
push edi
lea edx, [eax + ebp*8]
mov ecx, esi
call fcn.00434ae0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x434f3d
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x466f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov ebx, edx
mov dword [esp + 4], eax
push edi
test edx, edx
je 0x466f3d
cmp byte [edx], al
je 0x466f35
lea ecx, [ecx]
inc ebx
cmp byte [ebx], al
jne 0x466f30
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [ecx + 0x14], eax
jle 0x466fe8
push ebp
push esi
lea ebx, [ebx]
mov ebp, edi
cmp edi, 2
jge 0x466f5a
xor ebp, 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x466fb1
mov ecx, dword [ecx + 0x10]
mov edx, ebp
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x466f91
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5ad690]
cmp cl, byte [edx + 0x5ad690]
jne 0x466f91
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x466f74
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5ad690]
movzx ecx, byte [ecx + 0x5ad690]
sub eax, ecx
jne 0x466fd0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
add ebp, ebp
push ebx
mov ecx, dword [eax + ebp*8 + 0xc]
add ecx, 8
call fcn.00434da0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x466fe6
jmp 0x466fd4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc edi
mov edx, dword [esp + 0x18]
cmp edi, dword [ecx + 0x14]
jl 0x466f50
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret

Function at 0x467100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 8], edx
mov ebx, edx
push edi
test edx, edx
je 0x467125
cmp byte [edx], 0
je 0x46711d
inc ebx
cmp byte [ebx], 0
jne 0x467117
sub ebx, edx
and ebx, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4671dc
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x18], ecx
push esi
mov edi, edi
mov eax, edi
cmp edi, 2
jge 0x46714a
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4671ad
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x467191
jmp 0x467170
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5ad690]
cmp cl, byte [edx + 0x5ad690]
jne 0x46718d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x467170
mov edx, dword [esp + 0x10]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5ad690]
movzx ecx, byte [ecx + 0x5ad690]
sub eax, ecx
jne 0x4671bf
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [eax + 0x18]
call fcn.00434da0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4671d2
mov edx, dword [esp + 0x10]
inc edi
mov ecx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jl 0x467140
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4671f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x10]
mov ebp, dword [eax + edx*8 + 0xc]
add ebp, 0x18
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x46722e
cmp byte [ecx], 0
je 0x467226
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x467220
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebp]
xor ebx, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x467276
mov ebp, esi
test esi, esi
jle 0x467268
mov edi, ecx
movzx eax, byte [edi]
lea ecx, [ebx*8]
dec ebp
lea edi, [edi + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor ebx, edx
test ebp, ebp
jg 0x467243
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov eax, ebx
mov ebp, dword [esp + 0x1c]
xor edx, edx
div dword [esp + 0x18]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, ebp
push esi
call fcn.00434c90
add esp, 8
test eax, eax
je 0x4672e4
mov esi, dword [eax + 8]
mov edx, eax
push ebx
mov ecx, ebp
call fcn.00434d40
add esp, 4
test esi, esi
je 0x4672e4
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + 8]
cmp ecx, esi
jne 0x4672ae
mov eax, dword [esi + 0x14]
mov dword [edx + 8], eax
jmp 0x4672c7
test ecx, ecx
je 0x4672c7
mov eax, dword [ecx + 0x14]
cmp eax, esi
je 0x4672c1
mov ecx, eax
test ecx, ecx
jne 0x4672b2
jmp 0x4672c7
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi + 0x24]
mov ecx, edi
call fcn.0045eaf0
mov edx, dword [esi + 0x10]
mov ecx, edi
call fcn.00431240
mov edx, esi
mov ecx, edi
call fcn.00431240
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret