joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f90
Capabilities:
Create process on windows
Self delete

Disassembly:
sub esp, 0x104
push esi
call fcn.00403210
push eax
lea eax, [esp + 8]
push str._stttdelzzz.bat
push eax
call sub.MSVCRT.dll_sprintf
lea ecx, [esp + 0x10]
push 0x4053e0
push ecx
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x402fcc
pop esi
add esp, 0x104
ret
push edi
push str._echo_off_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.:start_r_n
push esi
call sub.MSVCRT.dll_fprintf
mov edi, dword [esp + 0x120]
push edi
push str.if_not_exist___s__goto_done_r_n
push esi
call sub.MSVCRT.dll_fprintf
push edi
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.goto_start_r_n
push esi
call sub.MSVCRT.dll_fprintf
push str.:done_r_n
push esi
call sub.MSVCRT.dll_fprintf
lea edx, [esp + 0x40]
push edx
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0x44
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
lea eax, [esp + 8]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
mov eax, ecx
pop esi
add esp, 0x104
ret
Function at 0x403060
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Get common file path
Read file on windows

Disassembly:
sub esp, 0xc6c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], bl
mov byte [esp + 0x47c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x47d]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4030e1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x7c]
push 0x400
push ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
mov word [esp + 0x60], bx
mov dword [esp + 0x5c], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.cmd.exe__c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x7c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xc80]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x6c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x80]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4031aa
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4031bb
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x484]
push 0x800
push ecx
push edx
call esi
test eax, eax
je 0x4031eb
push 0x64
call edi
jmp 0x4031c7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4031f6
push eax
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc6c
ret
Function at 0x403210
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4054b4
push 0x400
rep stosd dword es:[edi], eax
push 0x4054b4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40325f
mov edi, str.c:windows_temp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4054b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4054b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x4054b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4054b3], 0x5c
jne 0x40328b
mov edi, 0x4054b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x4054b2], al
push 0x5c
push 0x4054b4
call sub.MSVCRT.dll_strrchr
add esp, 8
test eax, eax
jne 0x4032c9
mov edi, str.c:windows_temp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x4054b4
mov edx, ecx
mov esi, edi
mov edi, 0x4054b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea edx, [eax + 1]
mov edi, str.temp_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4054b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x403300
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4058b4
push 0x400
rep stosd dword es:[edi], eax
push 0x4058b4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40334f
mov edi, str.c:windows_system32_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4058b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4058b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x4058b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4058b3], 0x5c
je 0x403394
mov edi, 0x405418
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4058b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x4058b4
pop esi
ret
Function at 0x4033a0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4060b4
push 0x400
rep stosd dword es:[edi], eax
push 0x4060b4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4033ef
mov edi, str.c:windowsdebug_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4060b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4060b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
mov edi, 0x4060b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4060b3], 0x5c
jne 0x40341b
mov edi, 0x4060b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x4060b2], al
push 0x5c
push 0x4060b4
call sub.MSVCRT.dll_strrchr
add esp, 8
test eax, eax
jne 0x403459
mov edi, str.c:windowsdebug_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x4060b4
mov edx, ecx
mov esi, edi
mov edi, 0x4060b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea edx, [eax + 1]
mov edi, str.debug_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4060b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x403490
Capabilities:
Get common file path

Disassembly:
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x405cb4
push 0x405cb4
push 0x400
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4034ba
call fcn.00403210
pop edi
ret
mov edi, 0x405cb4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x405cb3], 0x5c
je 0x403501
mov edi, 0x405418
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x405cb4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, 0x405cb4
pop edi
ret
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00414528
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.004044ca
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00414528
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00414528
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.0040ef83
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.0040ef68
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.0040ef68
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.004044ca
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x4044ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, 0x14
push ebx
push esi
push edi
push 0
sbb eax, 0
push eax
push ecx
push dword [ebp + 8]
call fcn.00414528
mov ebx, edx
add esp, 0x10
mov edi, eax
test ebx, ebx
jl 0x40453a
jg 0x4044f9
test edi, edi
jb 0x40453a
mov esi, dword [ebp + 0xc]
push 0x14
push esi
push dword [ebp + 8]
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x40453a
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x40453a
mov eax, edi
mov edx, ebx
jmp 0x40453f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4048f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 4], 0xffffffff
je 0x404a24
cmp dword [esi], 0xffffffff
je 0x404a24
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00414528
add esp, 0x10
test edx, edx
jl 0x404a24
jg 0x40493b
test eax, eax
jb 0x404a24
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.0040ef83
mov edi, eax
pop ecx
test edi, edi
je 0x404a24
mov ebx, dword [esi + 4]
push ebx
push edi
push dword [ebp + 8]
call fcn.004175dd
add esp, 0xc
cmp eax, ebx
jne 0x404a1d
cmp dword [esi + 0x10], 0
jne 0x404985
mov ecx, dword [ebp + 0x10]
mov byte [ebx + edi], 0
test ecx, ecx
je 0x40497e
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov eax, edi
jmp 0x404a26
cmp dword [esi + 0x10], 8
jne 0x404a1d
xor eax, eax
mov dword [ebp - 0x38], edi
push 0x38
push 0x427224
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x34], ebx
call fcn.00408372
add esp, 0x10
test eax, eax
js 0x404a1d
mov eax, dword [esi]
inc eax
push eax
call fcn.0040ef83
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404a1d
mov ecx, dword [esi]
lea eax, [ebp - 0x38]
push 1
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ecx
call fcn.00406d1a
pop ecx
pop ecx
push edi
test eax, eax
jns 0x4049f1
call fcn.0040ef68
push ebx
call fcn.0040ef68
pop ecx
jmp 0x404a23
mov eax, dword [esi]
mov byte [ebx + eax], 0
call fcn.0040ef68
lea eax, [ebp - 0x38]
push eax
call fcn.00408336
pop ecx
pop ecx
test eax, eax
jns 0x404a0e
push ebx
jmp 0x404a1e
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x404a19
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, ebx
jmp 0x404a26
push edi
call fcn.0040ef68
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f49d
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add al, dl
les eax, [eax]
add byte [eax], al
add byte [eax], al
add al, bl
les eax, [eax]
add byte [eax], al
add byte [eax], al
add ah, ah
les eax, [eax]
add byte [eax], al
add byte [eax], al
add al, dh
les eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax*8], al
add byte [eax], al
or al, 0xc5
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], bl
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax*8], ah
add byte [eax*8], ah
add byte [eax], al
xor al, 0xc5
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [ebp + eax*8], cl
add byte [eax], al
add byte [eax], al
add byte [eax - 0x3b], bl
add byte [eax], al
add byte [eax], al
add byte [eax], al
lds eax, fs:[eax]
add byte [eax], al
add byte [eax], al
add byte [eax - 0x3b], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
jl 0x41f4ab
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ch, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cwde
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [ebp + eax*8], ah
add byte [eax], al
add byte [eax + 0xc5], bh
add byte [eax], al
add ah, al
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add al, ah
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov byte [eax], 0
add byte [eax], al
add byte [eax], al
adc dh, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sbb al, 0xc6
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub dh, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor al, 0xc6
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
mov byte [eax], 0
add byte [eax], al
add byte [eax], al
dec esp
mov byte [eax], 0
add byte [eax], al
add byte [eax], al
pop eax
mov byte [eax], 0
add byte [eax], al
add byte [eax], al
mov byte fs:[eax], 0
add byte [eax], al
add byte [eax], al
jo 0x41f52c
add byte [eax], al
add byte [eax], al
add byte [eax], al
jl 0x41f534
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
test dh, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, byte [0xc6]
add byte [eax], al
add byte [esi + eax*8], dh
add byte [eax], al
enter 0xc6, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
loopne 0x41f56c
add byte [eax], al
add byte [eax], al
add byte [eax], al
ljmp 0
Function at 0x420905
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x410a98
lea eax, [ebp - 4]
xor edi, edi
push 0x413b60
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00421391
xor ecx, ecx
cmp eax, edi
sete cl
push 0x410aa0
push ecx
call fcn.00420859
push 2
push edi
push dword [ebp - 4]
call fcn.00422536
push dword [ebp - 4]
call fcn.00422241
cdq
mov dword [ebp - 0x18], eax
add eax, 0xfffffefc
add esp, 0x24
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x420966
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00422536
push dword [ebp - 4]
push 0x104
push 1
push ebx
call fcn.00421e51
push ebx
mov esi, eax
call fcn.004208c3
add esp, 0x20
cmp eax, edi
je 0x4209a8
mov esi, eax
sub eax, ebx
add eax, dword [ebp - 8]
push 5
cdq
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
jmp 0x420a26
mov esi, 0x4100000
push esi
call fcn.0042170f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfbf00000
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x4209c9
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00422536
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 0xc]
call fcn.00421e51
push dword [ebp - 0xc]
mov esi, eax
call fcn.004208c3
mov esi, eax
xor eax, eax
cmp esi, edi
setne al
push 0x410abc
mov dword [ebp - 0x14], esi
push eax
call fcn.00420859
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 5
add eax, dword [ebp - 8]
pop ecx
push dword [ebp - 0xc]
cdq
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
call fcn.0042148b
add esp, 0x2c
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
push 0
sub dword [ebp - 0x18], ecx
push dword [ebp - 0x18]
push dword [ebp - 4]
sbb esi, 0
call fcn.00422536
push dword [ebp - 4]
mov edi, 0x104
push edi
push 1
push ebx
call fcn.00421e51
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
mov esi, 0x410ae0
neg eax
push esi
push eax
call fcn.00420859
mov cx, word [ebx]
mov eax, 0x410afc
add esp, 0x24
cmp cx, word [eax]
jne 0x420a79
mov dword [ebp - 0x10], ebx
jmp 0x420acd
mov eax, dword [ebp - 0x18]
add eax, 0xfffffefc
jns 0x420a85
xor eax, eax
push 0
push eax
push dword [ebp - 4]
call fcn.00422536
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.00421e51
mov edi, eax
xor eax, eax
cmp eax, edi
sbb eax, eax
neg eax
push esi
push eax
call fcn.00420859
add esp, 0x24
lea eax, [edi + ebx - 1]
jmp 0x420ac4
mov dx, word [eax]
mov ecx, 0x410afc
cmp dx, word [ecx]
je 0x420aca
dec eax
cmp eax, ebx
jae 0x420ab6
jmp 0x420acd
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call fcn.004227f4
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x10009650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
cmp ebp, 1
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], 0
jne 0x1000969e
cmp ebx, ebp
jne 0x1000969e
movzx edx, byte [edi + 0x20]
call fcn.100087b0
movzx edx, byte [edi]
mov esi, eax
call fcn.100087b0
add esi, eax
mov eax, dword [esp + 0x30]
lea edx, [eax + eax]
cmp esi, edx
jne 0x1000969e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
xor esi, esi
test ebp, ebp
mov dword [esp + 0x10], esi
jle 0x100097b4
lea esp, [esp]
movzx edx, byte [esi + edi]
call fcn.100087b0
test ebx, ebx
mov ebp, eax
jle 0x100097a3
add edi, 0x20
mov dword [esp + 0x14], ebx
lea ebx, [ebx]
movzx esi, byte [edi]
mov edx, esi
call fcn.100087b0
sub eax, ebp
cmp eax, 0xffffff80
jge 0x100096e8
mov ebx, 0xffffff80
jmp 0x100096fa
cmp eax, 0x7f
jle 0x100096f4
mov ebx, 0x7f
jmp 0x100096fa
test eax, eax
mov ebx, eax
je 0x1000976f
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
sar eax, 1
add eax, 0x4000
cdq
idiv ebx
mov edx, dword [esp + 0x30]
sub edx, ebp
cmp edx, 0xffffff80
jge 0x1000971d
mov edx, 0xffffff80
jmp 0x10009727
cmp edx, 0x7f
jle 0x10009727
mov edx, 0x7f
imul edx, eax
add edx, 0x20
sar edx, 6
mov eax, edx
cmp eax, 0xfffffc00
jge 0x10009740
mov eax, 0xfffffc00
jmp 0x1000974c
cmp eax, 0x3ff
jle 0x1000974c
mov eax, 0x3ff
sar eax, 2
lea edx, [eax + 0x40]
cmp edx, 0xc0
ja 0x1000976d
mov ebx, 0x20
sub ebx, eax
je 0x1000976f
mov dword [esp + 0x18], 1
jmp 0x1000976f
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
movzx eax, byte [eax + edx]
and eax, 0x1f
shl eax, 5
add eax, dword [esp + 0x20]
and esi, 0x1f
add edi, 1
sub dword [esp + 0x14], 1
mov byte [esi + eax], bl
jne 0x100096d0
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
mov edi, edx
add esi, 1
cmp esi, dword [esp + 0x28]
mov dword [esp + 0x10], esi
jl 0x100096b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10046280
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
xor edi, edi
test ebx, ebx
mov esi, eax
mov ecx, 1
jbe 0x1004639c
push ebp
lea esp, [esp]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x100462af
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x1004635b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x100462d0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x100462d0
test eax, eax
je 0x1004636f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x10046360
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x100462a0
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret