joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b422
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040eed0
and dword [ebp - 0x14], 0
cmp dword [0x43a994], 0
mov dword [ebp - 0x18], eax
jne 0x41b4d5
push 0x404280
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b57d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404274
push ebx
call edi
test eax, eax
je 0x41b57d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404264
push ebx
mov dword [0x43a994], eax
call edi
push eax
call esi
push 0x404250
push ebx
mov dword [0x43a998], eax
call edi
push eax
call esi
push 0x404234
push ebx
mov dword [0x43a99c], eax
call edi
push eax
call esi
mov dword [0x43a9a4], eax
test eax, eax
je 0x41b4d5
push 0x40421c
push ebx
call edi
push eax
call esi
mov dword [0x43a9a0], eax
mov eax, dword [0x43a9a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b52e
cmp dword [0x43a9a4], ecx
je 0x41b52e
push eax
call esi
push dword [0x43a9a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b52e
test ebx, ebx
je 0x41b52e
call edi
test eax, eax
je 0x41b525
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b525
test byte [ebp - 8], 1
jne 0x41b52e
or dword [ebp + 0x10], 0x200000
jmp 0x41b561
mov eax, dword [0x43a998]
cmp eax, dword [ebp - 0x18]
je 0x41b561
push eax
call esi
test eax, eax
je 0x41b561
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b561
mov eax, dword [0x43a99c]
cmp eax, dword [ebp - 0x18]
je 0x41b561
push eax
call esi
test eax, eax
je 0x41b561
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43a994]
call esi
test eax, eax
je 0x41b57d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b57f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a320
leave
ret
Function at 0x41ead0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1280
call fcn.0041c2c0
cmp dword [0x8e4e04], 0x37
push esi
jne 0x41ebd1
push 0
lea eax, [esp + 0x284]
push eax
push 0x4043b4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call esi
xor eax, eax
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push 0
lea eax, [esp + 0x684]
push eax
push 0x4043c0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x60]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call esi
push 0x4043e8
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x38], 0
call fcn.00411b10
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x8e7568]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + ebx]
mov edx, dword [0x8e35f0]
mov byte [edx + ebx], cl
pop esi
add esp, 0x1280
ret
Function at 0x41ee60
Capabilities:
Accept command line arguments
Get geographical location
Query environment variable

Disassembly:
mov eax, dword [0x8e4e04]
mov ecx, dword [0x8e35f0]
sub esp, 0x974
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
je 0x41f046
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [0x4385e8]
mov edx, dword [0x4385ec]
mov dword [esp + 0x14], eax
mov eax, dword [0x4385f0]
mov dword [esp + 0x34], ecx
mov ecx, dword [0x4385f4]
mov ebx, 0xc6ef3720
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], 0x20
mov eax, edi
shl eax, 4
add eax, dword [esp + 0x28]
mov esi, edi
shr esi, 5
cmp dword [0x8e4e04], 0x1b
mov dword [esp + 0x10], eax
lea ebp, [ebx + edi]
jne 0x41ef08
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x30]
xor eax, ebp
xor edx, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov dword [0x8e35f4], edx
mov eax, dword [esp + 0x18]
add dword [0x8e35f4], eax
mov eax, dword [0x8e35f4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x38]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, ecx
shl eax, 4
add eax, dword [esp + 0x34]
cmp dword [0x8e4e04], 0x1be
mov dword [esp + 0x10], eax
lea esi, [ebx + ecx]
jne 0x41ef9e
push edx
lea eax, [esp + 0x184]
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
shr ecx, 5
add ecx, dword [esp + 0x2c]
cmp dword [0x8e4e04], 0x979
mov dword [0x8e35f8], 0xff6b3619
mov dword [0x8e35fc], 0xffffffff
mov dword [esp + 0x18], ecx
jne 0x41efda
lea ecx, [esp + 0x40]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x10]
xor eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
sub edi, dword [esp + 0x10]
add ebx, 0x61c88647
dec dword [esp + 0x20]
jne 0x41eec5
cmp dword [0x8e4e04], 0x8d4
jne 0x41f00e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [eax], edi
mov dword [eax + 4], edx
cmp dword [0x8e4e04], 0x17
jne 0x41f031
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [esp + 0x1c]
add ecx, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
jne 0x41ee88
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x6f20407c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x749f6877
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2cf6c86
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x33661b37
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x7f31350c
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2b33577
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x41c260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x54d9a8]
push esi
add ebx, 0x30
mov esi, ecx
push edi
mov edi, edx
mov dword [0x54d9a8], ebx
mov dword [ebp - 4], edi
movzx eax, word [edi + 0x4c]
mov word [ebp - 0x18], ax
movzx eax, word [edi + 0x4e]
mov word [ebp - 0x16], ax
movzx eax, word [edi + 0x50]
mov dword [ebx], 0x4000
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x4000
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0x4000
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x2c], 0
mov dx, word [edi + 0x4c]
mov cx, word [edi + 0x4e]
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0x50]
push eax
call fcn.00401420
mov edx, dword [esi + 4]
add esp, 4
mov edi, dword [esi + 8]
mov esi, dword [esi]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
imul eax, esi
imul ecx, edi
add ecx, eax
mov eax, dword [ebx + 4]
imul eax, edx
add ecx, eax
mov eax, dword [ebp - 4]
sar ecx, 0xe
mov eax, dword [eax + 0x40]
add eax, ecx
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
imul eax, esi
imul ecx, edx
add ecx, eax
mov eax, dword [ebx + 0x18]
imul eax, edi
add ecx, eax
mov eax, dword [ebp - 4]
sar ecx, 0xe
mov eax, dword [eax + 0x44]
add eax, ecx
mov ecx, dword [ebx + 0x24]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x20]
imul ecx, edx
mov edx, dword [ebp - 4]
imul eax, esi
add ecx, eax
mov eax, dword [ebx + 0x28]
imul eax, edi
add ecx, eax
lea eax, [ebx - 0x30]
sar ecx, 0xe
add ecx, dword [edx + 0x48]
mov dword [0x54d9a8], eax
mov eax, 0xb3
cmp word [edx + 0xc], ax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ecx
jne 0x41c440
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov edx, edi
mov ebx, dword [ebp - 0xc]
push ecx
movzx eax, word [esi + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push edi
push eax
push ecx
mov ecx, ebx
call fcn.0041e0e0
add esp, 8
mov edx, ebx
mov ecx, eax
call fcn.0041e450
mov ecx, dword [esi + 0x44]
add esp, 8
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x200
jle 0x41c3d9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x48]
lea eax, [esi + 0x40]
mov esi, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, edi
sub edi, ecx
sub eax, ecx
imul eax, edi
mov edi, dword [ebp - 0x10]
mov ecx, edi
sub ecx, edx
sub edi, edx
imul ecx, edi
mov edi, 0x40000000
add eax, ecx
mov ecx, ebx
sub ecx, esi
sub ebx, esi
imul ecx, ebx
add eax, ecx
xor esi, esi
nop dword [eax]
lea edx, [esi + edi]
shr esi, 1
mov ecx, esi
or ecx, edi
cmp edx, eax
cmovbe esi, ecx
mov ecx, eax
sub ecx, edx
shr edi, 2
cmp edx, eax
cmovbe eax, ecx
test edi, edi
jne 0x41c410
cmp esi, 0x80
jae 0x41c448
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
add ecx, 0x40
jmp 0x41c44b
mov ecx, dword [ebp - 0xc]
sub esp, 8
lea edx, [ebp - 0x24]
call fcn.0041c0b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c9d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi + 0x4c]
cmp word [edx], 0
je 0x43cae4
movzx eax, word [esi + 6]
add ax, word [edx + 8]
movsx ecx, word [esi + 0xe]
mov word [esi + 6], ax
movsx eax, word [edx + 0xc]
add dword [esi + 0x32], eax
movzx eax, word [edx + 0x14]
add word [esi + 0x2a], ax
movzx eax, word [esi + 8]
add ax, word [edx + 0x10]
mov word [esi + 8], ax
mov eax, dword [esi]
mov ecx, dword [eax + ecx*4]
movzx eax, word [edx + 0x18]
add word [ecx + 0x16], ax
movzx eax, word [edx + 0x1c]
add word [ecx + 0x1c], ax
mov eax, dword [ecx + 0x26]
add eax, dword [edx + 0x22]
mov dword [ecx + 0x26], eax
mov eax, dword [edx + 0x2a]
add dword [ecx + 0x2e], eax
add word [edx], 0xffff
jne 0x43cae4
cmp word [edx + 8], 0
mov ax, word [edx + 4]
mov word [edx + 2], ax
je 0x43ca56
xor eax, eax
mov word [edx + 8], ax
mov ax, word [edx + 6]
mov word [esi + 6], ax
cmp word [edx + 0xc], 0
je 0x43ca6a
xor eax, eax
mov word [edx + 0xc], ax
movsx eax, word [edx + 0xa]
mov dword [esi + 0x32], eax
cmp word [edx + 0x14], 0
je 0x43ca7f
xor eax, eax
mov word [edx + 0x14], ax
mov ax, word [edx + 0x12]
mov word [esi + 0x2a], ax
cmp word [edx + 0x18], 0
je 0x43ca94
xor eax, eax
mov word [edx + 0x18], ax
mov ax, word [edx + 0x16]
mov word [ecx + 0x16], ax
cmp word [edx + 0x1c], 0
je 0x43caa9
xor eax, eax
mov word [edx + 0x1c], ax
mov ax, word [edx + 0x1a]
mov word [ecx + 0x1c], ax
cmp dword [edx + 0x22], 0
je 0x43cabc
mov eax, dword [edx + 0x1e]
mov dword [edx + 0x22], 0
mov dword [ecx + 0x26], eax
cmp dword [edx + 0x2a], 0
je 0x43cacf
mov eax, dword [edx + 0x26]
mov dword [edx + 0x2a], 0
mov dword [ecx + 0x2e], eax
cmp word [edx + 0x10], 0
je 0x43cae4
xor eax, eax
mov word [edx + 0x10], ax
mov ax, word [edx + 0xe]
mov word [esi + 8], ax
cmp word [esi + 0xa], 0
je 0x43cb1c
mov ax, word [esi + 0x16]
add word [esi + 0x2a], ax
add word [esi + 0xc], 0xffff
jne 0x43cb1c
movzx eax, word [esi + 0x10]
movsx ecx, word [esi + 0x14]
mov word [esi + 0xe], ax
cwde
imul ecx, eax
mov eax, 0xffffc000
sub ax, cx
mov word [esi + 0x2a], ax
xor eax, eax
mov word [esi + 0xa], ax
pop esi
ret
Function at 0x44b7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
movzx eax, word [esi + 0x18]
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
push eax
push dword [esi + 0x48]
call fcn.00429000
movzx eax, word [esi + 0x18]
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
push eax
push 1
push 0xfffffffffffffffe
push 2
push dword [esi + 0x48]
call fcn.00427ae0
add esp, 0x1c
mov edi, 3
nop dword [eax]
movzx eax, word [esi + 0x18]
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
push eax
push 1
push 0xffffffffffffffff
push 2
push dword [esi + 0x48]
call fcn.00427ae0
add esp, 0x14
sub edi, 1
jne 0x44b7f0
movzx eax, word [esi + 0x18]
mov ebx, dword [esi + 0x40]
mov ecx, ebx
push eax
push dword [esi + 0x48]
call fcn.0041e2b0
add esp, 8
cmp eax, 0xffff8100
je 0x44b90a
mov ecx, dword [esi + 0x44]
sub ecx, eax
cmp ecx, 0x800
jge 0x44b90a
mov dword [0x6e45c8], ebx
mov edi, 0x800
movsx eax, word [esi + 0x18]
sub edi, ecx
lea ecx, [eax + eax*4]
mov eax, dword [0x6e0d8c]
add ecx, ecx
mov eax, dword [eax + ecx*8 + 0x24]
mov dword [0x6e45cc], eax
mov eax, dword [esi + 0x48]
mov dword [0x6e45d0], eax
mov eax, edi
sar eax, 6
movzx ecx, ax
mov edx, ecx
mov dword [0x6e45d8], 0xa0ffa0
mov dword [0x6e45de], 0x70060
mov dword [0x6e45e6], 0xe0ffc0
lea eax, [ecx + 0x10]
mov dword [0x6e45ec], 0x80038
mov word [0x6e45d4], ax
lea eax, [ecx + 0xc]
mov word [0x6e45d6], ax
mov eax, 0xfffffe00
movzx ecx, di
sub eax, ecx
mov dword [0x6e45f4], 0x90110
shl eax, 3
mov word [0x6e45dc], ax
lea eax, [edx + 0x18]
mov word [0x6e45e2], ax
mov word [0x6e45e4], ax
mov eax, 0xfffffd00
sub eax, ecx
mov ecx, 0x6e45c8
shl eax, 2
pop edi
mov word [0x6e45ea], ax
lea eax, [edx + 0x20]
pop esi
mov word [0x6e45f0], ax
mov word [0x6e45f2], ax
pop ebx
jmp fcn.0042a330
pop edi
pop esi
pop ebx
ret
Function at 0x456480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x6e85a4]
mov ebx, ecx
push edi
mov edx, dword [esi + 0x40]
sub edx, dword [ebx + 0xc]
mov edi, dword [esi + 0x48]
sub edi, dword [ebx + 0x14]
lea eax, [edx + 0x3e80]
cmp eax, 0x7d00
ja 0x4564c3
lea eax, [edi + 0x3e80]
cmp eax, 0x7d00
ja 0x4564c3
mov ecx, edi
mov eax, edx
imul ecx, edi
imul eax, edx
add ecx, eax
jmp 0x4564c8
mov ecx, 0x7fff
movsx eax, word [ebx + 6]
imul eax, eax
cmp ecx, eax
jl 0x4564dc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
or word [esi + 0x82], 0x10
mov eax, 0xffffff38
add word [esi + 0x22], ax
mov ecx, edi
call fcn.00408a30
movzx edi, ax
movzx eax, word [esi + 0x4e]
mov ebx, edi
sub ax, di
cwde
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x4000
jl 0x456521
mov eax, 0xffffffb5
mov word [esi + 0x1e], ax
lea eax, [edi - 0x8000]
movzx eax, ax
jmp 0x45652c
mov eax, 0x4b
mov word [esi + 0x1e], ax
mov eax, ebx
mov word [esi + 0x4e], ax
mov eax, 0xffffffce
or word [esi + 0x82], 8
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
mov word [esi + 0x20], ax
xor eax, eax
mov word [esi + 0x4c], ax
mov word [esi + 0x50], ax
mov eax, 0x22
mov word [esi + 0x14], ax
mov eax, dword [0x6e0d84]
mov ax, word [eax + 0x450]
mov word [esi + 0x16], ax
movzx eax, word [esi + 0x18]
push eax
push 2
push 0xfffffffffffffffe
push 3
push dword [esi + 0x48]
mov dword [esi + 0xe], 0x30003
call fcn.00427ae0
mov edi, dword [0x517424]
add esp, 0x14
mov ebx, 3
nop dword [eax]
nop word [eax + eax]
movzx ecx, word [esi + 0x18]
imul edi, edi, 0x41c64e6d
add edi, 0x3039
mov dword [ebp - 4], edi
mov dword [0x517424], edi
call fcn.0043e810
movzx eax, ax
cmp ax, 0xffff
je 0x456651
mov ecx, dword [0x6e5d50]
cwde
lea eax, [eax + eax*4]
lea edx, [ecx + eax*8]
imul ecx, edi, 0x41c64e6d
add ecx, 0x3039
mov eax, ecx
imul edi, ecx, 0x41c64e6d
mov ecx, dword [ebp - 4]
sar eax, 0xa
and eax, 0x1f
sar ecx, 0xa
add eax, 0x40
mov word [edx + 0x1a], ax
add edi, 0x3039
mov eax, dword [esi + 0x40]
mov dword [edx], eax
mov eax, dword [esi + 0x44]
mov dword [edx + 4], eax
mov eax, dword [esi + 0x48]
mov dword [edx + 8], eax
mov eax, 0x2000
mov word [edx + 0xc], ax
mov eax, edi
sar eax, 0xa
and eax, 0x7fff
mov dword [0x517424], edi
mov dword [edx + 0x24], 0x10001
lea eax, [eax + ecx*2]
add eax, 0x4000
mov word [edx + 0xe], ax
mov eax, 0x174
mov word [edx + 0x14], ax
xor eax, eax
mov word [edx + 0x1c], ax
mov eax, 1
sub ebx, eax
jne 0x4565a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469f80
Capabilities:
Read file on windows

Disassembly:
cmp byte [0x6ef711], 0
jne 0x46a0c7
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0xfffe
xor esi, esi
nop dword [eax]
mov ecx, edi
call fcn.00469e90
and word [esi + 0x6ef203], bx
xor eax, eax
mov dword [esi + 0x6ef20b], 0
inc edi
mov dword [esi + 0x6ef20f], 0
mov dword [esi + 0x6ef213], 0
mov dword [esi + 0x6ef217], 0
mov dword [esi + 0x6ef21b], eax
add esi, 0x33
cmp esi, 0x4c8
jl 0x469fa0
or word [0x6ef203], 1
or word [0x6ef236], 1
and dword [0x6ef71e], 0xff800001
push 0x50f4d8
push str.data.bin
mov dword [0x6ef198], eax
mov dword [0x6ef1c0], eax
mov dword [0x6ef19c], eax
mov dword [0x6ef1c4], eax
mov dword [0x6ef1a0], eax
mov dword [0x6ef1c8], eax
mov dword [0x6ef1a4], eax
mov dword [0x6ef1cc], eax
mov dword [0x6ef1a8], eax
mov dword [0x6ef1d0], eax
mov dword [0x6ef1ac], eax
mov dword [0x6ef1d4], eax
mov dword [0x6ef1b0], eax
mov dword [0x6ef1d8], eax
mov dword [0x6ef1b4], eax
mov dword [0x6ef1dc], eax
mov dword [0x6ef1b8], eax
mov dword [0x6ef1e0], eax
mov dword [0x6ef1bc], eax
mov dword [0x6ef1e4], eax
mov dword [0x6ef1e8], eax
mov byte [0x6ef711], al
mov byte [0x6ef71d], al
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x46a0c4
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
push 0xa
push 4
push 0x6ef198
call esi
push edi
push 0xa
push 4
push 0x6ef1c0
call esi
push edi
push 1
push 4
push 0x6ef1e8
call esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x34
pop edi
pop esi
pop ebx
ret
Function at 0x4890e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x7b7477], 0
push esi
mov dword [ebp - 4], edx
mov esi, ecx
je 0x4892da
mov byte [0x7b7866], 1
nop
cmp byte [0x7b78ce], 0
jne 0x489100
cmp byte [0x7b7477], 0
je 0x489126
mov ecx, dword [0x7c2928]
test ecx, ecx
je 0x4892da
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
cmp dword [0x7c2928], 0
je 0x4892da
cmp esi, 0x82
jg 0x4892da
push ebx
imul ebx, esi, 0x10c
cmp dword [ebx + 0x7ba214], 0
je 0x4892d9
mov eax, dword [ebx + 0x7ba218]
push 0
push 0
add eax, 0x5a
push eax
push dword [0x7c2a8c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0x7c2aa8
push 0x5800
push dword [0x7c2a9c]
mov dword [0x7c2ac8], esi
push dword [0x7c2a8c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x7c2aa8]
push dword [0x6f3a1c]
mov dword [0x7c2aac], eax
mov eax, dword [0x7c2928]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7c2928]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0x7c2aa4
push 0x7c2aa0
push dword [0x7c2ab8]
push 0
push eax
call dword [ecx + 0x2c]
mov esi, dword [sym.imp.MSACM32.dll_acmStreamConvert]
push 0x14
push 0x7c2930
push dword [0x7c2a88]
call esi
push 0
push 0x7c2aa8
push 0x5800
push dword [0x7c2a9c]
push dword [0x7c2a8c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x7c2aa8]
add dword [0x7c2aac], eax
push 4
push 0x7c2984
push dword [0x7c2a88]
call esi
mov eax, dword [0x7c2928]
push 0
push 0
push dword [0x7c2ab8]
mov ecx, dword [eax]
push dword [0x7c2aa0]
push eax
call dword [ecx + 0x4c]
cmp dword [0x7c2928], 0
je 0x489285
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x7c2ab0], eax
mov eax, dword [0x7c2928]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x7c2928]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x7c2928]
push dword [0x6f3a1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x7c2928]
push 1
push 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov eax, dword [0x7c2ac0]
add eax, eax
mov dword [0x7c2abc], 2
cmp dword [ebp - 4], 0
mov dword [0x7c2ac4], eax
mov eax, dword [ebx + 0x7ba214]
setne byte [0x7b78cc]
cmp dword [0x7c2aac], eax
jbe 0x4892cd
mov dword [0x7c2aac], eax
mov al, 1
pop ebx
mov byte [0x7b78cd], al
mov byte [0x7b7866], 0
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [0x7b78cd], al
mov byte [0x7b7866], al
pop ebx
pop esi
mov esp, ebp
pop ebp
ret