joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c350
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x140c]
mov eax, 0x140c
call fcn.00512410
push 0xffffffffffffffff
push 0x53c0cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58213c]
xor eax, ebp
mov dword [ebp + 0x1408], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1418]
mov esi, dword [ebp + 0x1414]
mov dword [ebp - 0x10], esi
cmp eax, 0x11
ja case.default.0x41c3a1
jmp dword [eax*4 + 0x41c554]
mov eax, 0x28
jmp 0x41c3f7
mov eax, 5
jmp 0x41c3f7
xor eax, eax
jmp 0x41c3f7
mov eax, 0x1a
jmp 0x41c3f7
mov eax, 0x23
jmp 0x41c3f7
mov eax, 0x2e
jmp 0x41c3f7
mov eax, 0x26
jmp 0x41c3f7
mov eax, 0x2a
jmp 0x41c3f7
mov eax, 0x1c
jmp 0x41c3f7
mov eax, 0xd
jmp 0x41c3f7
mov eax, 0xe
jmp 0x41c3f7
mov eax, 0x27
push 0
push eax
lea eax, [ebp + 0x1000]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x41c3a1
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00408ac0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00420b70
mov ecx, dword [ebp - 0x10]
add esp, 0x10
add ecx, 0xfffffff8
cmp ecx, section..data
je 0x41c52e
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x41c52e
push ecx
call fcn.00511f41
add esp, 4
jmp 0x41c52e
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00408ac0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00420b70
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0040d480
jmp 0x41c52e
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00408ac0
mov dword [ebp - 4], 1
jmp 0x41c48f
mov eax, dword [0x5886e4]
test eax, eax
jne 0x41c509
push 0x5886e4
push 0x5886e4
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x41c4fc
mov eax, dword [0x5886e4]
test eax, eax
jne 0x41c509
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x5886e4], eax
push eax
push esi
call fcn.0041b2d0
add esp, 8
jmp 0x41c52e
push 0
push esi
call fcn.0041b2d0
add esp, 8
jmp 0x41c52e
mov dword [esi], 0
mov dword [esi], 0x582008
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x1408]
xor ecx, ebp
call fcn.00511b56
lea esp, [ebp + 0x140c]
pop ebp
ret 8
Function at 0x41cae0
Capabilities:
Get http content length

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x41cafa
mov ecx, dword [esi + 4]
push 0
mov byte [esi + 8], 1
call fcn.00413210
mov eax, dword [esi + 4]
pop esi
mov eax, dword [eax + 0x40]
test eax, eax
je 0x41cb45
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 4], 0
push ecx
lea ecx, [esp + 8]
mov dword [esp + 0x10], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41cb45
mov eax, dword [esp]
xor edx, edx
add esp, 0xc
ret
or eax, 0xffffffff
or edx, eax
add esp, 0xc
ret
Function at 0x41eed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ba50
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58213c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00413a00
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ef2c
test eax, 0x400
je 0x41ef2c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x420ac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b24d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58213c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x54fba4
push ecx
mov ecx, esp
mov eax, dword [eax]
mov dword [ecx], eax
add eax, 0xfffffff8
cmp eax, section..data
je 0x420aff
lock inc dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.0040f120
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00413a00
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
cmp ecx, section..data
je 0x420b48
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x420b48
push ecx
call fcn.00511f41
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4216b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x421729
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x421719
lea eax, [esp + 0x10]
push eax
call fcn.0041c290
mov ecx, dword [esi + 0x18]
add esp, 4
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
cmp ecx, section..data
je 0x421719
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x421719
push ecx
call fcn.00511f41
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
pop ecx
ret 8
xor eax, eax
add dword [esi + 0x10], eax
adc dword [esi + 0x14], eax
pop esi
pop ecx
ret 8

Function at 0x421930
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x421947
mov ecx, dword [esi + 4]
push 0
mov byte [esi + 8], 1
call fcn.00413210
mov ecx, dword [esp + 8]
xor eax, eax
mov esi, dword [esi + 4]
test ecx, ecx
je 0x421988
mov dword [esp + 8], eax
cmp byte [esi + 0x58], al
jne 0x421988
mov edx, dword [esi + 0x40]
test edx, edx
je 0x421988
lea eax, [esp + 8]
push eax
push dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 8]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], 0
test eax, eax
jne 0x421988
mov byte [esi + 0x58], 1
pop esi
ret 8
Function at 0x426f90
Capabilities:
Read data from internet
Receive data

Disassembly:
push ecx
push edi
mov edi, dword [ecx + 4]
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x426fa3
xor al, al
pop edi
pop ecx
ret 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
cmp ebx, dword [edi + 0x50]
jne 0x426fbb
cmp ebp, dword [edi + 0x54]
je 0x4270a4
push 0
push 0
push 0
push ebx
push eax
mov byte [edi + 0x58], 0
call dword [sym.imp.WININET.dll_InternetSetFilePointer]
xor ecx, ecx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
cmp eax, ebx
jne 0x426fe6
cmp ebp, ecx
jne 0x426fe8
pop ebp
pop ebx
mov al, 1
pop edi
pop ecx
ret 8
cmp ebp, ecx
jg 0x426ff9
jl 0x426ff0
cmp ebx, eax
jae 0x426ff9
pop ebp
pop ebx
xor al, al
pop edi
pop ecx
ret 8
sub ebx, eax
push esi
sbb ebp, ecx
js 0x427020
jg 0x42700a
cmp ebx, 0x4000
jbe 0x427020
mov eax, 0x4000
push eax
mov dword [esp + 0x1c], eax
call fcn.00517259
add esp, 4
mov esi, eax
jmp 0x427040
mov eax, ebx
push eax
mov dword [esp + 0x1c], eax
call fcn.00517259
add esp, 4
mov esi, eax
test ebp, ebp
jl 0x42709a
jg 0x427040
test ebx, ebx
je 0x42709a
nop dword [eax + eax]
cmp byte [edi + 0x58], 0
jne 0x42709a
mov ecx, dword [esp + 0x18]
mov eax, ecx
cdq
cmp edx, ebp
jg 0x427057
jl 0x427059
cmp eax, ebx
jb 0x427059
mov ecx, ebx
xor eax, eax
test esi, esi
je 0x42708b
mov edx, dword [edi + 0x40]
mov dword [esp + 0x10], eax
test edx, edx
je 0x42708b
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
add dword [edi + 0x50], eax
adc dword [edi + 0x54], 0
test eax, eax
jne 0x42708b
mov byte [edi + 0x58], 1
cdq
sub ebx, eax
sbb ebp, edx
test ebp, ebp
jg 0x427040
jl 0x42709a
test ebx, ebx
jne 0x427040
push esi
call fcn.0051723e
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
pop ecx
ret 8
Function at 0x4277b0
Capabilities:
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cd24
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x58213c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x1c
call fcn.005118c7
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4278ea
push 0
lea ecx, [ebp - 0x20]
mov byte [esi], 0
push ecx
lea ebx, [esi + 8]
mov dword [esi + 4], 0
lea eax, [esi + 4]
mov dword [ebx], 0
push ebx
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4278ec
push 0
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4278ec
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x64], 0x44
test cl, 1
je 0x42788f
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
jmp 0x427896
mov dword [ebp - 0x28], 0
test cl, 2
je 0x4278a2
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
jmp 0x4278a9
mov dword [ebp - 0x24], 0
push dword [ebp + 8]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], 0x100
push eax
call fcn.00413a00
add esp, 8
mov ecx, dword [eax]
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8000400
push 1
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov byte [esi], al
jmp 0x4278ec
xor esi, esi
mov ebx, dword [edi]
mov dword [edi], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x427928
cmp byte [ebx], 0
je 0x427909
push dword [ebx + 0x10]
call edi
push dword [ebx + 0xc]
call edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x427913
push eax
call edi
mov eax, dword [ebx + 8]
test eax, eax
je 0x42791d
push eax
call edi
push 0x1c
push ebx
call fcn.005118f7
add esp, 8
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx]
cmp byte [esi], 0
jne 0x42796a
mov dword [ebx], 0
test esi, esi
je 0x42796a
cmp byte [esi], 0
je 0x42794b
push dword [esi + 0x10]
call edi
push dword [esi + 0xc]
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x427955
push eax
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x42795f
push eax
call edi
push 0x1c
push esi
call fcn.005118f7
add esp, 8
cmp dword [ebx], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427a10
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor dl, dl
lea eax, [edi + 0x101]
xchg byte [eax], dl
lea eax, [esp + 0xc]
push eax
push 4
push edi
push 0x4281b0
push dword [edi + 0xf8]
push 0
call fcn.0051a970
add esp, 0x18
lea esi, [edi + 0xc]
xchg dword [esi], eax
mov eax, dword [esi]
nop
test eax, eax
je 0x427acf
mov eax, dword [esp + 0xc]
lea ebx, [edi + 0x10]
xchg dword [ebx], eax
mov ecx, dword [esi]
nop
push dword [esp + 0x14]
mov al, byte [edi + 0x1c]
push ecx
push eax
call fcn.00427110
add esp, 0xc
test al, al
mov eax, dword [esi]
nop
je 0x427aad
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esi, [edi + 0x3c]
push esi
call fcn.0050fa88
add esp, 4
test eax, eax
jne 0x427ad8
mov cl, 1
lea eax, [edi + 0x94]
xchg byte [eax], cl
lea eax, [edi + 0x6c]
push eax
call fcn.0050fbd4
push esi
call fcn.0050faad
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
test eax, eax
je 0x427abd
mov eax, dword [esi]
nop
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
nop
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xchg dword [ebx], eax
xor eax, eax
xchg dword [esi], eax
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
push eax
call fcn.0050fd83
int3
Function at 0x427b50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cd65
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58213c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
mov dword [ebp - 4], 0
nop
test eax, eax
je 0x427c67
mov ecx, esi
call fcn.004272c0
lea ebx, [esi + 0x9c]
push ebx
call fcn.0050fa88
add esp, 4
test eax, eax
jne 0x427c89
mov cl, 1
lea eax, [esi + 0xf4]
xchg byte [eax], cl
lea eax, [esi + 0xcc]
push eax
call fcn.0050fbd4
push ebx
call fcn.0050faad
mov eax, dword [ebp + 8]
add esp, 8
test eax, eax
je 0x427be7
push eax
mov ecx, esi
call fcn.00429950
mov eax, dword [edi]
nop
test eax, eax
je 0x427c67
lea eax, [ebp + 8]
push str.___killing_thread_by_force___
push eax
call fcn.00408a10
add esp, 8
mov ecx, dword [0x588738]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x427c18
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
call dword [eax + 4]
jmp 0x427c21
lea eax, [ebp + 8]
push eax
call fcn.00420ac0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
cmp ecx, section..data
je 0x427c45
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x427c45
push ecx
call fcn.00511f41
add esp, 4
mov eax, dword [edi]
nop
test eax, eax
je 0x427c58
mov eax, dword [edi]
nop
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
xchg dword [edi], eax
xor ecx, ecx
lea eax, [esi + 0x10]
xchg dword [eax], ecx
xor bl, bl
jmp 0x427c69
mov bl, 1
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.0050fd83
int3
Function at 0x42a0e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42a154
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a14b
lea eax, [esp + 0x10]
push eax
call fcn.0041c290
mov edx, eax
add esp, 4
mov eax, dword [esi + 0x10]
mov ecx, dword [edx]
mov dword [esi + 0x10], ecx
mov dword [edx], eax
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
cmp ecx, section..data
je 0x42a14b
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x42a14b
push ecx
call fcn.00511f41
add esp, 4
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8

Function at 0x42a910
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x42a919
ret
mov dword [esp + 8], eax
jmp fcn.00413d20
Function at 0x42b720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x42b8a7
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x42b8a7
cmp dword [ecx + 0x20], 0
je 0x42b8a7
cmp dword [ecx + 0x24], 0
je 0x42b8a7
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x42b781
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
push esi
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
lea eax, [esi + 0x988]
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0x28], 0
mov dword [esi + 0xb20], 0x582010
mov dword [esi + 0xb2c], 0x582024
mov dword [esi + 0xb38], 0x582038
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.0041e500
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00514400
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x54ec1a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x54ec18]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x54ec1c]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x54ec1e]
mov dword [esi + 0x7c], eax
xor eax, eax
pop edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x42f730
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret 4
Function at 0x439bb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ecx
cmp eax, ecx
je 0x439dbc
push ebx
push ebp
push esi
push edi
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], ecx
cmp edx, ecx
jge 0x439da7
mov edi, dword [esp + 0x40]
nop dword [eax + eax]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [esp + 0x40]
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
imul edx, dword [ecx + 0xc]
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
imul ecx, ebp
mov dword [esp + 0x14], ebx
sub ebp, dword [edi + 0xc]
mov dword [esp + 0x18], eax
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x439d48
mov esi, dword [edi + 4]
mov eax, ebp
cdq
inc ebp
mov ebx, dword [edi + 8]
mov dword [esp + 0x2c], ebp
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
mov edx, 0x100
add esi, dword [edi + 0x18]
mov edi, dword [ecx]
movzx eax, byte [esi + 1]
movzx ebp, byte [esi + 2]
or eax, 0xff0000
imul eax, ebx
shl ebp, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [esp + 0x28], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [esi]
or ebp, eax
mov esi, 0x100
mov eax, edi
imul ebp, ebx
mov ebx, dword [esp + 0x28]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
shr ebp, 8
shr eax, 8
and ebp, 0xff00ff
and eax, 0xff00ff
add ebp, eax
shr edi, 8
mov edx, ebp
and edi, 0xff00ff
shr edx, 8
add ebx, edi
and edx, 0xff00ff
mov eax, ebx
mov edi, dword [esp + 0x40]
shr eax, 8
and eax, 0xff00ff
sub esi, eax
mov eax, ebx
shl eax, 8
shl esi, 8
or esi, eax
mov eax, 0x100
sub eax, edx
mov edx, 0x100
or eax, ebp
mov ebp, dword [esp + 0x2c]
xor esi, eax
mov eax, ebx
shr eax, 8
and esi, 0xff00ff
and eax, 0xff00ff
shl ebx, 8
sub edx, eax
mov eax, dword [esp + 0x14]
shl edx, 8
dec eax
or edx, ebx
mov dword [esp + 0x14], eax
xor esi, edx
mov dword [ecx], esi
add ecx, dword [esp + 0x18]
test eax, eax
jg 0x439c50
jmp 0x439d8c
mov esi, dword [edi + 4]
mov eax, ebp
cdq
dec ebx
inc ebp
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
movzx edx, byte [esi + 2]
or edx, 0xffffff00
mov word [esp + 0x10], ax
movzx eax, byte [esp + 0x11]
shl edx, 8
or edx, eax
movzx eax, byte [esp + 0x10]
shl edx, 8
or edx, eax
mov dword [ecx], edx
add ecx, dword [esp + 0x18]
test ebx, ebx
jg 0x439d48
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
inc edx
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x30]
jl 0x439c00
mov eax, dword [esp + 0x20]
add eax, 0x10
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x38]
jne 0x439bd2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x43be60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ecx
cmp eax, ecx
je 0x43c039
push ebx
push ebp
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], ecx
cmp edx, ecx
jge 0x43c024
mov edi, dword [esp + 0x40]
nop dword [eax + eax]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x14], ebp
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
imul edx, dword [ecx + 0xc]
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
imul ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
sub ebx, dword [edi + 0xc]
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x43bfd2
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
mov ebp, dword [edi + 8]
mov dword [esp + 0x2c], ebx
idiv dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov esi, 0x100
imul ebx, edx
add ebx, dword [edi + 0x18]
movzx edx, byte [ebx + 1]
or edx, 0xff0000
movzx edi, byte [ebx + 2]
imul edx, ebp
shl edi, 0x10
shr edx, 8
and edx, 0xff00ff
mov eax, edx
shr eax, 0x10
sub esi, eax
movzx eax, byte [ecx + 1]
imul eax, esi
shr eax, 8
add eax, edx
movzx edx, byte [ecx + 2]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx]
or edi, eax
mov ebx, dword [esp + 0x28]
movzx eax, byte [ecx]
shl edx, 0x10
or edx, eax
imul edi, ebp
imul edx, esi
shr edi, 8
shr edx, 8
and edi, 0xff00ff
and edx, 0xff00ff
add edi, edx
mov edx, 0x100
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shr eax, 8
or edx, edi
mov edi, dword [esp + 0x40]
neg al
or al, bl
and edx, 0xff00ff
mov ebx, dword [esp + 0x2c]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x14]
dec eax
mov byte [ecx], dl
add ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
test eax, eax
jg 0x43bf02
jmp 0x43c009
mov esi, dword [edi + 4]
mov eax, ebx
cdq
dec ebp
inc ebx
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
mov dl, byte [esi + 2]
mov word [esp + 0x10], ax
movzx eax, al
mov byte [ecx], al
movzx eax, byte [esp + 0x11]
mov byte [ecx + 1], al
mov byte [ecx + 2], dl
add ecx, dword [esp + 0x18]
test ebp, ebp
jg 0x43bfd2
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
inc edx
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x30]
jl 0x43beb0
mov eax, dword [esp + 0x20]
add eax, 0x10
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x38]
jne 0x43be82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4