joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
lea eax, [ebp - 0x18]
mov esi, 0x200
lea edx, [ebp - 0x28]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x40eef0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], 2
mov dword [edx + 8], eax
cmp esi, 0x201
jae 0x40e71b
lea ebx, [ebp - 0x44c]
mov edx, 0x200
mov edi, esi
jmp 0x40e768
mov eax, dword [ebp - 0x20]
sub esi, eax
jb 0x40e835
mov edx, dword [ebp - 0x28]
mov ecx, edx
sub ecx, eax
cmp ecx, esi
jae 0x40e749
mov dword [ebp - 0x10], 0
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042ade6
add esp, 0xc
mov edx, dword [ebp - 0x28]
cmp edx, 0x3fffffff
mov dword [ebp - 0x20], edx
ja 0x40e84b
mov ebx, dword [ebp - 0x24]
mov edi, edx
mov eax, ebx
and eax, 1
jne 0x40e84b
mov dword [ebp - 0x2c], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x40e78b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40e7ef
cmp esi, edi
jne 0x40e7a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40e85a
add edi, edi
mov esi, edi
jmp 0x40e704
ja 0x40e704
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x40e877
lea eax, [ebp - 0x3c]
push esi
push ebx
push eax
call fcn.0040ada6
add esp, 0xc
movsd xmm0, qword [ebp - 0x3c]
movsd xmm1, qword [ebp - 0x34]
mov esi, dword [ebp + 8]
movsd qword [ebp - 0x44], xmm1
movsd qword [ebp - 0x4c], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
jmp 0x40e808
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40e81f
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.004025f0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x432e1c
call fcn.0042b1d9
add esp, 4
jmp 0x40e886
push 0xa6
push 0x432b1f
call fcn.0042af2f
mov dword [ebp - 0x10], 0
push 0x432e64
push 0x28
push str.internal_error:_entered_unreachable_code._C
call fcn.0042aef5
add esp, 0xc
jmp 0x40e886
push 0x432e2c
push eax
push esi
call fcn.0042b259
add esp, 0xc
ud2
Function at 0x412807
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], ecx
push 1
push 0x43452b
push dword [edx + 4]
push dword [edx]
call fcn.0040f7b1
add esp, 0x10
cmp edx, 0x10
jbe 0x412832
xor esi, esi
jmp 0x41291c
xor esi, esi
inc esi
test edx, edx
je 0x412918
add edx, eax
xor edi, edi
xor ebp, ebp
mov dword [esp], edx
mov bl, byte [eax]
lea esi, [eax + 1]
movzx ecx, bl
test bl, bl
js 0x412856
mov eax, esi
jmp 0x4128ca
cmp esi, edx
je 0x412941
movzx esi, byte [eax + 1]
and ecx, 0x1f
lea edx, [eax + 2]
and esi, 0x3f
cmp bl, 0xdf
jbe 0x4128b5
cmp edx, dword [esp]
je 0x412941
lea edx, [eax + 3]
shl esi, 6
mov dword [esp + 4], edx
movzx edx, byte [eax + 2]
and edx, 0x3f
or edx, esi
cmp bl, 0xf0
jb 0x4128be
mov esi, dword [esp + 4]
cmp esi, dword [esp]
je 0x412941
movzx esi, byte [eax + 3]
and ecx, 7
shl edx, 6
add eax, 4
shl ecx, 0x12
and esi, 0x3f
or esi, edx
jmp 0x4128ba
shl ecx, 6
mov eax, edx
or ecx, esi
jmp 0x4128c7
mov eax, dword [esp + 4]
shl ecx, 0xc
or ecx, edx
mov edx, dword [esp]
mov esi, ecx
xor esi, 0xd800
add esi, 0xffef0000
cmp esi, 0xffef07ff
jbe 0x412935
lea esi, [ecx - 0x30]
cmp esi, 0xa
jb 0x412900
or ecx, 0x20
mov esi, 0xffffffff
add ecx, 0xffffff9f
add ecx, 0xa
cmovb ecx, esi
cmp ecx, 0x10
mov esi, ecx
jae 0x412946
shld ebp, edi, 4
shl edi, 4
or edi, esi
cmp eax, edx
jne 0x412846
xor ecx, ecx
xor esi, esi
inc esi
jmp 0x41291e
xor edi, edi
xor ebp, ebp
xor ecx, ecx
mov eax, dword [esp + 8]
mov dword [eax + 8], edi
mov dword [eax], esi
mov dword [eax + 0xc], ebp
mov dword [eax + 4], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x39
push 0x43417a
call fcn.0042af2f
call fcn.00411ee4
push 0x43452c
call fcn.0042ae50
Function at 0x41b3a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41b418
lea eax, [edx + eax*2]
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
mov esi, eax
lea ebp, [edx + 2]
jne 0x41b3ec
cmp esi, edi
ja 0x41b46e
mov eax, dword [esp + 0x1c]
lea edi, [eax + ebx]
mov eax, esi
sub eax, ebx
test eax, eax
je 0x41b3f5
dec eax
cmp byte [edi], cl
lea edi, [edi + 1]
jne 0x41b3de
jmp 0x41b414
ja 0x41b418
cmp ebp, dword [esp]
jne 0x41b3fe
jmp 0x41b418
cmp ebp, dword [esp]
mov edi, dword [esp + 0x20]
je 0x41b418
movzx eax, byte [edx + 3]
mov edx, ebp
mov ebx, esi
add eax, esi
jae 0x41b3c2
push 0x43a4d0
call fcn.0042b1ad
xor eax, eax
jmp 0x41b45a
mov edx, dword [esp + 0x28]
test edx, edx
je 0x41b458
mov esi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edx, esi
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x41b439
mov esi, edi
jmp 0x41b44c
cmp edi, edx
je 0x41b464
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x41b45a
xor al, 1
cmp esi, edx
jne 0x41b42b
jmp 0x41b45a
mov al, 1
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43a4e0
call fcn.0042ae50
push 0x43a4f0
push dword [esp + 0x24]
push esi
call fcn.0042b259

Function at 0x41c9c7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ca06
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ca06
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ca06
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ca06
cmp dword [ecx + 0x74], 0xe
jbe 0x41ca06
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x423c63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x423d00
push ebx
push esi
call fcn.00423c2c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00423bc0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423cad
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423cff
push edi
push eax
call fcn.00424880
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423ccd
call fcn.00422721
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423cfe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00423bc0
add esp, 0x20
test eax, eax
jne 0x423cec
push edi
call fcn.00422721
jmp 0x423cf4
push ebx
call fcn.00422721
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x424ffd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43dba8
push 0x43dba0
push str.FlsAlloc
push 0x1f
call fcn.00424ebc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425031
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c190]
call esi
jmp 0x425037
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42507b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43dbb8
push 0x43dbb0
push str.FlsGetValue
push 0x21
call fcn.00424ebc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4250b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c190]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4250ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43dbc0
push 0x43dbb8
push str.FlsSetValue
push 0x22
call fcn.00424ebc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4250f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c190]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42a550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42a57d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42a57d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x505e1f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
cmp dword [eax + 0x10], 0
je 0x505e203
xor al, al
add esp, 0x24
ret
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x34]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x48]
neg ecx
sbb ecx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x38]
and ecx, 0xff
shl ecx, 8
neg edx
sbb edx, edx
and edx, 0xff
or ecx, edx
mov edx, dword [eax + 0x28]
shl ecx, 8
neg edx
sbb edx, edx
push ebx
mov ebx, dword [eax + 0x3c]
and edx, 0xff
push esi
mov esi, dword [eax + 0x1c]
or ecx, edx
mov edx, dword [esp + 0x34]
push edi
mov edi, dword [eax + 0x2c]
shl ecx, 8
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edx
je 0x505e306
push ebp
jmp 0x505e280
mov edx, dword [esp + 0x44]
sub dword [esp + 0x40], 1
test edx, edx
je 0x505e2dd
lea ecx, [ecx]
movzx eax, byte [esi]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x30], eax
movzx eax, byte [edi]
add esi, dword [esp + 0x20]
add edi, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx]
add ebx, dword [esp + 0x28]
shl eax, 8
or eax, dword [esp + 0x2c]
sub edx, 1
shl eax, 8
or eax, dword [esp + 0x30]
add ebp, 4
shl eax, 8
xor eax, ecx
test edx, edx
mov dword [ebp - 4], eax
mov dword [esp + 0x10], ebp
jne 0x505e290
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
add esi, dword [eax + 0x20]
add edi, dword [eax + 0x30]
add ebx, dword [eax + 0x40]
cmp dword [esp + 0x40], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
jne 0x505e280
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x24
ret
Function at 0x505e310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
cmp dword [esi + 0x10], 0
je 0x505e31f
xor al, al
add esp, 0x20
ret
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x44]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x48]
neg ecx
sbb ecx, ecx
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x3c]
and ecx, 0xff
shl ecx, 8
push ebp
mov ebp, dword [esi + 0x1c]
push edi
mov edi, dword [esi + 0x38]
neg edi
sbb edi, edi
and edi, 0xff
or ecx, edi
mov edi, dword [esi + 0x28]
shl ecx, 8
neg edi
sbb edi, edi
and edi, 0xff
or ecx, edi
mov edi, dword [esp + 0x2c]
shl ecx, 8
cmp dword [esp + 0x30], 0
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 8], edi
je 0x505e40a
push ebx
nop
mov edi, dword [esp + 0x38]
sub dword [esp + 0x34], 1
test edi, edi
mov dword [esp + 0x10], eax
je 0x505e3ed
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx]
add ebx, 4
xor eax, ecx
mov dword [esp + 0xc], ebx
mov ebx, eax
shr ebx, 8
mov byte [ebp], bl
add ebp, dword [esp + 0x20]
mov ebx, eax
shr ebx, 0x10
mov byte [edx], bl
add edx, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x10]
shr ebx, 0x18
mov byte [eax], bl
add eax, dword [esp + 0x28]
sub edi, 1
test edi, edi
mov dword [esp + 0x10], eax
jne 0x505e3a1
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ebp, dword [esi + 0x20]
add edx, dword [esi + 0x30]
add eax, dword [esi + 0x40]
cmp dword [esp + 0x34], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jne 0x505e390
pop ebx
pop edi
mov al, 1
pop ebp
add esp, 0x20
ret
Function at 0x505f590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x3c
cmp dword [edx + 0x10], 0
push esi
mov esi, dword [esp + 0x4c]
je 0x505f5a5
xor al, al
pop esi
add esp, 0x3c
ret
mov ecx, dword [edx + 0x4c]
mov dword [esp + 8], ecx
mov ecx, dword [edx + 0x24]
mov dword [esp + 0x20], ecx
mov ecx, dword [edx + 0x34]
mov dword [esp + 0x24], ecx
mov ecx, dword [edx + 0x44]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx + 0x54]
mov dword [esp + 0x30], ecx
mov ecx, dword [edx + 0x58]
neg ecx
sbb ecx, ecx
push ebx
mov ebx, dword [edx + 0x48]
and ecx, 0xff
shl ecx, 8
neg ebx
sbb ebx, ebx
mov eax, dword [edx + 0x3c]
and ebx, 0xff
or ecx, ebx
mov ebx, dword [edx + 0x38]
shl ecx, 8
neg ebx
sbb ebx, ebx
and ebx, 0xff
or ecx, ebx
mov ebx, dword [edx + 0x28]
shl ecx, 8
neg ebx
sbb ebx, ebx
and ebx, 0xff
push ebp
mov ebp, dword [edx + 0x2c]
or ecx, ebx
cmp dword [esp + 0x50], 0
mov ebx, dword [esp + 0x4c]
push edi
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ebx
je 0x505f704
jmp 0x505f640
sub dword [esp + 0x54], 1
test esi, esi
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebx
je 0x505f6d1
jmp 0x505f664
mov ebp, dword [esp + 0x34]
movzx eax, byte [edi]
mov dword [esp + 0x48], eax
movzx eax, byte [ebp]
add ebp, dword [esp + 0x30]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
add edi, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
movzx eax, byte [ebx]
mov ebx, dword [esp + 0x38]
add dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x3c]
shl eax, 8
or eax, dword [esp + 0x40]
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x1c]
shl eax, 8
or eax, dword [esp + 0x44]
sub esi, 1
shl eax, 8
or eax, dword [esp + 0x48]
add ebp, 4
xor eax, ecx
test esi, esi
mov dword [ebp - 4], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
jne 0x505f660
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
add edi, dword [edx + 0x20]
add ebp, dword [edx + 0x30]
add eax, dword [edx + 0x40]
mov ebx, dword [edx + 0x50]
add dword [esp + 0x14], ebx
cmp dword [esp + 0x54], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
jne 0x505f640
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x3c
ret
Function at 0x505f710
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x30
cmp dword [esi + 0x10], 0
je 0x505f71f
xor al, al
add esp, 0x30
ret
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x44]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x58]
neg ecx
sbb ecx, ecx
and ecx, 0xff
push ebx
shl ecx, 8
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x3c]
mov ebx, dword [esi + 0x4c]
push ebp
push edi
mov edi, dword [esi + 0x48]
neg edi
sbb edi, edi
mov ebp, dword [esi + 0x1c]
and edi, 0xff
or ecx, edi
mov edi, dword [esi + 0x38]
shl ecx, 8
neg edi
sbb edi, edi
and edi, 0xff
or ecx, edi
mov edi, dword [esi + 0x28]
shl ecx, 8
neg edi
sbb edi, edi
and edi, 0xff
or ecx, edi
cmp dword [esp + 0x44], 0
mov edi, dword [esp + 0x40]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], edi
je 0x505f85b
mov edi, dword [esp + 0x48]
sub dword [esp + 0x44], 1
test edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ebx
je 0x505f834
lea esp, [esp]
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx]
add ebx, 4
xor eax, ecx
mov dword [esp + 0x10], ebx
mov byte [ebp], al
add ebp, dword [esp + 0x2c]
mov ebx, eax
shr ebx, 8
mov byte [edx], bl
mov ebx, dword [esp + 0x18]
mov edx, eax
shr edx, 0x10
mov byte [ebx], dl
mov edx, dword [esp + 0xc]
add ebx, dword [esp + 0x34]
shr eax, 0x18
mov byte [edx], al
mov edx, dword [esp + 0x14]
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
add dword [esp + 0xc], eax
sub edi, 1
test edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
jne 0x505f7d0
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
add ebp, dword [esi + 0x20]
add edx, dword [esi + 0x30]
add eax, dword [esi + 0x40]
add ebx, dword [esi + 0x50]
cmp dword [esp + 0x44], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
jne 0x505f7b0
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret
Function at 0x5060630
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xd0
mov eax, dword [0x509ddfc]
xor eax, esp
mov dword [esp + 0xcc], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0xd8]
cmp dword [ecx + 0x10], 0
push ebp
mov ebp, dword [esp + 0xe8]
mov dword [esp + 8], ebx
je 0x5060679
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xcc]
xor ecx, esp
call fcn.05070186
add esp, 0xd0
ret
xor eax, eax
test ebp, ebp
jbe 0x50606b0
add ecx, 0x24
mov edx, dword [ecx - 8]
mov dword [esp + eax*4 + 0x10], edx
mov edx, dword [ecx]
mov dword [esp + eax*4 + 0x88], edx
mov edx, dword [ecx + 4]
neg edx
sbb dl, dl
add eax, 1
add ecx, 0x10
and edx, 0xff
cmp eax, ebp
mov byte [esp + eax + 0xc3], dl
jb 0x5060682
cmp dword [esp + 0xe0], 0
je 0x5060766
push esi
push edi
sub dword [esp + 0xe8], 1
test ebp, ebp
jbe 0x50606d8
mov ecx, ebp
lea esi, [esp + 0x18]
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0xec]
test edx, edx
je 0x5060736
mov ecx, ebp
neg ecx
lea edi, [esp + 0xcc]
mov dword [esp + 0x14], ecx
sub edi, ebx
sub edx, 1
xor eax, eax
test ebp, ebp
jbe 0x506072a
mov ecx, ebx
nop
mov esi, dword [esp + eax*4 + 0x54]
mov bl, byte [edi + ecx]
xor bl, byte [esi]
add eax, 1
mov byte [ecx], bl
mov ebx, dword [esp + eax*4 + 0x8c]
add ebx, esi
mov dword [esp + eax*4 + 0x50], ebx
add ecx, 1
cmp eax, ebp
jb 0x5060700
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ebx, ebp
add edi, ecx
test edx, edx
mov dword [esp + 0x10], ebx
jne 0x50606f4
xor eax, eax
test ebp, ebp
jbe 0x5060756
mov ecx, dword [esp + 0xe4]
add ecx, 0x20
mov edx, dword [ecx]
add dword [esp + eax*4 + 0x18], edx
add eax, 1
add ecx, 0x10
cmp eax, ebp
jb 0x5060746
cmp dword [esp + 0xe8], 0
jne 0x50606c0
pop edi
pop esi
mov ecx, dword [esp + 0xd4]
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.05070186
add esp, 0xd0
ret
Function at 0x5060780
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc8
mov eax, dword [0x509ddfc]
xor eax, esp
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xd0]
cmp dword [ecx + 0x10], 0
push ebx
mov ebx, dword [esp + 0xdc]
push ebp
mov ebp, dword [esp + 0xe4]
je 0x50607ca
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.05070186
add esp, 0xc8
ret
xor eax, eax
test ebp, ebp
jbe 0x5060801
add ecx, 0x24
mov edx, dword [ecx - 8]
mov dword [esp + eax*4 + 8], edx
mov edx, dword [ecx]
mov dword [esp + eax*4 + 0x80], edx
mov edx, dword [ecx + 4]
neg edx
sbb dl, dl
add eax, 1
add ecx, 0x10
and edx, 0xff
cmp eax, ebp
mov byte [esp + eax + 0xbb], dl
jb 0x50607d3
cmp dword [esp + 0xdc], 0
je 0x50608c3
push esi
push edi
sub dword [esp + 0xe4], 1
test ebp, ebp
jbe 0x5060829
mov ecx, ebp
lea esi, [esp + 0x10]
lea edi, [esp + 0x4c]
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
mov edx, ebx
je 0x5060893
mov eax, dword [esp + 0xdc]
mov edi, eax
lea ecx, [esp + 0xc4]
sub edi, ecx
mov ecx, ebx
imul ecx, ebp
add eax, ecx
mov dword [esp + 0xdc], eax
nop
sub edx, 1
xor eax, eax
test ebp, ebp
jbe 0x506088d
lea esp, [esp]
mov esi, dword [esp + eax*4 + 0x4c]
lea ecx, [esp + eax + 0xc4]
mov bl, byte [edi + ecx]
xor bl, byte [ecx]
mov ecx, dword [esp + eax*4 + 0x88]
add ecx, esi
mov dword [esp + eax*4 + 0x4c], ecx
add eax, 1
cmp eax, ebp
mov byte [esi], bl
jb 0x5060860
mov ebx, dword [esp + 0xe8]
add edi, ebp
test edx, edx
jne 0x5060850
xor eax, eax
test ebp, ebp
jbe 0x50608b3
mov ecx, dword [esp + 0xe0]
add ecx, 0x20
mov edx, dword [ecx]
add dword [esp + eax*4 + 0x10], edx
add eax, 1
add ecx, 0x10
cmp eax, ebp
jb 0x50608a3
cmp dword [esp + 0xe4], 0
jne 0x5060811
pop edi
pop esi
mov ecx, dword [esp + 0xcc]
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.05070186
add esp, 0xc8
ret
Function at 0x5068bec
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 8], 0
pop esi
ret

Function at 0x5070186
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x509ddfc]
jne 0x5070190
repz ret
jmp fcn.05070b04
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x41835c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ac2c
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418424
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ac2c
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524907
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4184ca
cmp edi, dword [esi + 0x7c]
jge 0x4184ca
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cd6e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cd6e
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac2c
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac2c
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x41841c
jmp 0x4183ec
call fcn.00430f95
int3