joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40502a
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4031a8
call esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x405147
push 0x4031b8
call esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, 0xffffffff
je 0x405147
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call fcn.00409b80
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x405146
cmp dword [0x40c5f8], ebx
jg 0x4050ab
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x4031d0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
test eax, eax
je 0x405133
add dword [0x40c5f8], 0x2415
push 0x4031e8
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x405146
mov ecx, dword [0x40c600]
mov eax, dword [0x40c604]
lea eax, [ecx + eax - 0x236]
push edi
mov dword [0x40c600], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
pop edi
test eax, eax
je 0x405146
sub dword [0x40c5f0], 0x6ab
push 0x403214
call esi
push 0x403224
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x405146
mov eax, dword [0x40c604]
mov ecx, dword [0x40c5f8]
lea eax, [ecx + eax*2]
mov dword [0x40c604], eax
pop ebx
pop esi
leave
ret
Function at 0x40514a
Capabilities:
Get session user name
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_IsWindowUnicode]
push eax
call ebx
test eax, eax
je 0x4052e4
and dword [ebp - 0x2c], 0
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
je 0x4052e4
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x403288
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4052e4
call esi
push eax
call ebx
test eax, eax
je 0x4052e4
add dword [0x40c600], 0x7935
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4052e4
push 0x4032b0
push 1
mov ebx, 0x1f0001
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4052d1
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
add dword [0x40c5f4], 0xbe3
call esi
test eax, eax
jne 0x4052e4
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp word [ebp - 0x10], 0xf
jne 0x4052e4
mov eax, dword [0x40c5f4]
sub eax, dword [0x40c600]
push 0x4032bc
add dword [0x40c604], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
test eax, eax
jne 0x4052e4
mov eax, dword [0x40c5fc]
mov ecx, dword [0x40c600]
lea eax, [eax + ecx*2]
mov dword [0x40c5fc], eax
xor eax, eax
push 0x122
push eax
mov word [ebp - 0x158], ax
lea eax, [ebp - 0x156]
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - 8], 0x92
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4052e4
push 0x4032ec
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4052e4
mov eax, dword [0x40c5f4]
sub eax, dword [0x40c600]
add dword [0x40c604], eax
jmp 0x4052e4
mov ecx, dword [0x40c600]
mov eax, dword [0x40c5f8]
lea eax, [eax + ecx*2]
mov dword [0x40c600], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409115
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x401b70]
jne 0x40911f
repz ret
jmp fcn.0040ad0f
Function at 0x4097a6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004077de
and dword [ebp - 4], 0
cmp dword [0x40c190], 0
mov ebx, eax
jne 0x409857
push 0x402690
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409908
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402684
push edi
call esi
test eax, eax
je 0x409908
push eax
call fcn.0040776c
mov dword [esp], 0x402674
push edi
mov dword [0x40c190], eax
call esi
push eax
call fcn.0040776c
mov dword [esp], 0x402660
push edi
mov dword [0x40c194], eax
call esi
push eax
call fcn.0040776c
mov dword [esp], 0x402644
push edi
mov dword [0x40c198], eax
call esi
push eax
call fcn.0040776c
pop ecx
mov dword [0x40c1a0], eax
test eax, eax
je 0x409857
push 0x40262c
push edi
call esi
push eax
call fcn.0040776c
pop ecx
mov dword [0x40c19c], eax
mov eax, dword [0x40c19c]
cmp eax, ebx
je 0x4098af
cmp dword [0x40c1a0], ebx
je 0x4098af
push eax
call fcn.004077e7
push dword [0x40c1a0]
mov esi, eax
call fcn.004077e7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4098af
test edi, edi
je 0x4098af
call esi
test eax, eax
je 0x4098a6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4098a6
test byte [ebp - 0xc], 1
jne 0x4098af
or dword [ebp + 0x10], 0x200000
jmp 0x4098e8
mov eax, dword [0x40c194]
cmp eax, ebx
je 0x4098e8
push eax
call fcn.004077e7
pop ecx
test eax, eax
je 0x4098e8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4098e8
mov eax, dword [0x40c198]
cmp eax, ebx
je 0x4098e8
push eax
call fcn.004077e7
pop ecx
test eax, eax
je 0x4098e8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c190]
call fcn.004077e7
pop ecx
test eax, eax
je 0x409908
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40990a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a92a
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
push dword [0x571674]
push dword [0x549004]
call dword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x571674]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x18], eax
mov eax, dword [0x571674]
mov eax, dword [eax]
shr eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x42a9b9
cmp eax, 1
je 0x42a9f0
cmp eax, 2
je 0x42aa19
cmp eax, 4
je 0x42aa34
cmp eax, 5
je 0x42aa68
cmp eax, 3
je 0x42aa90
call fcn.0042a9b0
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
shr eax, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18]
imul edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x42aab2
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
imul edx
pop edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x42aab2
mov eax, dword [0x571674]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
and eax, 0xffff
pop edx
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x42aab2
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax
jmp 0x42aab2
mov eax, dword [0x571674]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x571674]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax

Function at 0x42ae43
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42ae7a
cmp eax, 2
je 0x42aeaa
cmp eax, 4
je 0x42aeda
call fcn.0042ae71
mov eax, dword [ebp + 8]
mov al, byte [eax + 2]
cmp al, 0x5b
je 0x42aec1
mov eax, 0
jmp 0x42b814
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov eax, 4
mov dword [ebp - 0x10], 4
jmp 0x42af08
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
cmp al, 0x5b
je 0x42aef1
mov eax, 0
jmp 0x42b814
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp + 8], eax
mov eax, 8
mov dword [ebp - 0x10], 8
Function at 0x42be99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [0x571664]
cmp eax, 0
je 0x42bee9
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x42bed3
and eax, 0xff
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
and eax, 0xff
push eax
call fcn.0042b881
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0
jne 0x42beb7
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
jmp 0x42bf1c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [0x549004]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0042f5cf
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x42c14c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, dword [ebp - 0xc]
dec eax
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x434f3c
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov cl, dl
shl eax, cl
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x38
jne 0x434fb5
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
cmp eax, 0
jl 0x434fb5
jmp 0x434fb9
xor eax, eax
jmp 0x434fbc
xor eax, eax
inc eax
cmp eax, 0
je 0x434ff4
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x28], eax
jmp 0x43501c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
sub eax, edx
push eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
sar eax, cl
shl eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [0x5777fc]
mov dword [ebp - 0x20], eax
jmp 0x435132
Function at 0x43d1a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x5778b0]
cmp eax, edx
jle 0x43d1cd
mov eax, dword [ebp - 0xc]
mov dword [0x5778b0], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [0x571704]
mov edx, eax
mov eax, dword [ebp - 0xc]
push edx
mov edx, 0xc
mov ecx, edx
imul ecx
pop edx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
dec eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [0x57ac30]
cmp eax, 0
je 0x43d24e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call fcn.0044fc62
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
sub eax, 3
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp eax, 0x3e
je 0x43d2d4
push 0
push dword [str._n_r_t__e]
push 3
push 0
push 0x3e
push 2
push 0
push 0x584e68
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp + 8]
push 2
push 0
push str._Found:
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp - 0xc]
push 2
push 0
push str._Datatype_Error:_invalid_actions_count_for_type:
push 6
push 0x6c
lea esi, [esp + 4]
push esi
push 9
call fcn.00425453
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0xc]
shl eax, 8
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x43d2f6
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x43d2f6
jmp 0x43d2fa
xor eax, eax
jmp 0x43d2fd
xor eax, eax
inc eax
cmp eax, 0
je 0x43d32b
mov eax, dword [ebp - 0x14]
shl eax, 8
inc eax
push eax
mov eax, 0x3e
mov edx, dword [ebp + 8]
sub eax, edx
pop edx
xchg edx, eax
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [0x571708]
mov edi, dword [ebp - 0x18]
dec edi
mov eax, dword [eax + edi*4]
jmp 0x43d330
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [0x571708]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x43d2de
leave
pop esi
pop ecx
pop ecx
pop ecx
add esp, ecx
push esi
ret
Function at 0x444f4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
push 0
push dword [0x571a14]
push dword [ebp + 8]
call fcn.00439a19
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x444ff4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 3
je 0x444fe9
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x444fde
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0042f873
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov edx, eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
jb 0x444fab
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x18]
cmp eax, 0
je 0x445039
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
push 0
push dword [0x571a18]
push dword [ebp + 8]
call fcn.00439a19
mov eax, dword [ebp + 8]
leave
ret 0x1c

Function at 0x447b37
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x447b52
call fcn.0048aeca
jmp 0x447b55
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, 2
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x14]
cmp eax, 0
je 0x447bb6
cmp eax, 0xffffffff
je 0x447bce
push 0
push str._Loading_Error:_input_encoding_unsupported
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.00425453
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x447be9
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043281b
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
jmp 0x447be9
xor eax, eax
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043299b
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, 7
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
leave
ret 0x10
Function at 0x4520e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
jmp 0x4521fe
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x452164
cmp eax, 0x11
je 0x452174
cmp eax, 0x12
je 0x452174
cmp eax, 0x13
je 0x452190
cmp eax, 0x10
je 0x4521ee
mov eax, 0
jmp 0x4521f3
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4521f3
mov eax, dword [ebp - 0x24]
xor al, 1
cmp eax, 0
je 0x452187
xor eax, eax
jmp 0x45221a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4521f3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
mov dword [ebp - 0x20], eax
mov eax, dword [0x571af4]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
je 0x4521d4
mov eax, dword [0x571af8]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
je 0x4521d4
xor eax, eax
jmp 0x4521d7
xor eax, eax
inc eax
cmp eax, 0
je 0x4521e5
jmp 0x45220c
xor eax, eax
jmp 0x45221a
jmp 0x45220c
mov eax, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jb 0x452129
mov eax, dword [ebp - 0x1c]
cmp eax, 2
sete al
xor ah, ah
cwde
leave
ret 4
Function at 0x459624
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x3c
mov eax, dword [0x577ef4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
cmp eax, 8
jne 0x459648
mov eax, dword [ebp - 0xc]
jmp 0x459996
mov eax, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x1e
je 0x45969f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
push eax
call fcn.0043d3a4
push eax
push 0xc
push dword [0x5824f8]
call fcn.004561ef
push eax
push 3
push dword [0x5824e8]
call fcn.004561ef
push eax
push 0xc
lea esi, [esp + 4]
push esi
push 3
call fcn.0042fa34
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
cmp eax, edx
jle 0x459715
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0x80000
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0x80000
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x40]
call fcn.0042e00f
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
xor al, 1
cmp eax, 0
je 0x459775
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
or eax, 0x80000
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, 0
mov dword [ebp - 0x30], 0
jmp 0x459842
Function at 0x465477
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sar eax, 0x13
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
and eax, 0xff
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
dec edi
mov al, byte [eax + edi]
and eax, 0xff
push eax
call fcn.0044d31a
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00447a9c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x46550e
mov eax, dword [ebp + 0x14]
dec eax
mov dword [ebp + 0x14], eax
mov al, 0x2e
and eax, 0xff
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.0044657c
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov edx, eax
mov eax, dword [ebp + 0x14]
sub eax, edx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x4654a8
mov eax, dword [ebp + 0x14]
leave
ret 0x10

Function at 0x488bc3
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0x100
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x577ed0], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
and eax, 1
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x488c1e
mov eax, dword [ebp - 0xc]
shr eax, 1
jmp 0x488c29
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jne 0x488c03
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [0x577ed0]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x101
jne 0x488bf0
leave
ret