joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404eac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404ecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404f6d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x404eed
test byte [esp + 8], 2
je 0x404eed
mov dword [0x40d054], 0xd
mov dword [0x40d058], 5
jmp 0x404ec8
xor eax, eax
ret

Function at 0x40698d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40cb18
cmp edx, dword [eax]
je 0x4069af
add eax, 8
inc ecx
cmp eax, 0x40cba8
jl 0x4069a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40cb18]
jne 0x406add
mov eax, dword [0x40d0a8]
cmp eax, 1
je 0x406ab7
test eax, eax
jne 0x4069e0
cmp dword [0x40c6d4], 1
je 0x406ab7
cmp edx, 0xfc
je 0x406add
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406a17
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406ae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406c30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406a5a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406c30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a4d4
push edi
call fcn.004046b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406ae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406af0
lea eax, [ebp - 0xa0]
push 0x40a4b4
push eax
call fcn.00406af0
push dword [esi + 0x40cb1c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406af0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408b5a
add esp, 0x2c
pop edi
jmp 0x406add
lea eax, [ebp + 8]
lea esi, [esi + 0x40cb1c]
push 0
push eax
push dword [esi]
call fcn.00406c30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4012e7
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.004a7c60
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov esi, 0x3b9aca00
xor ebx, ebx
mov ebp, edx
or ebp, ebx
jne 0x4012d2
mul esi
mov esi, eax
mov ebp, edx
mov dword [esp + 0x48], edi
mov eax, edi
cdq
mov ebx, eax
mov ecx, edx
mov eax, esi
mov edx, ebp
add eax, ebx
adc edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0045f9d0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], al
lea eax, [esp + 0x50]
xor ebp, ebp
mov dword [eax], ebp
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
xchg ebp, ebx
mov byte [eax + 0x10], bl
xchg ebp, ebx
mov dword [esp + 0x2c], edx
mov dword [eax], edx
mov dword [esp + 0x30], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x28], eax
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov esi, edi
mov dword [esp + 0x3c], edi
xor eax, eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jge 0x40125f
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045fed0
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x70]
cmp ebx, ebp
jae 0x4012cb
mov ebp, dword [esp + 0x6c]
add ebp, ebx
movzx ebx, byte [ebp]
mov byte [esp + 0x23], bl
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, eax
inc ebx
cmp ebx, esi
ja 0x40128f
mov edi, ebx
mov dword [esp + 0x38], ebx
mov ebx, ecx
add ebx, eax
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx], al
xchg ebp, eax
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jl 0x4011f6
mov dword [esp], 0
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00440110
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x78], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x7c], ebx
add esp, 0x64
ret
mov dword [esp], 0x5c4440
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
call fcn.0043c470
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, eax
inc edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ecx
jmp 0x401241
call fcn.00428880
ud2
imul edx, esi
mov ebp, eax
imul ebp, ebx
add ebp, edx
mov edx, esi
mul edx
add edx, ebp
jmp 0x40116e
call fcn.00450fb0
jmp fcn.00401110
Function at 0x40a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a23b
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a22e
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a22e
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a109
mov ebx, 0x5fe6c1
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a540
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a18c
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40a13a
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40a160
inc eax
cmp eax, 8
jb 0x40a11e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40a117
mov ebx, 0x6da6c0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a134
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a22a
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a117
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a226
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a226
mov eax, 1
cmp al, 0
jne 0x40a117
mov ecx, edx
jmp 0x40a117
xor eax, eax
jmp 0x40a216
xor ebx, ebx
jmp 0x40a1c3
mov ebx, 0x6da6c0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.00450fb0
jmp fcn.0040a0b0
Function at 0x40a250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a3ee
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a3dc
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a3dc
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a2a9
mov ebx, 0x5fe6c1
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a540
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a33a
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40a2de
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40a309
inc eax
cmp eax, 8
jb 0x40a2c2
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40a2bb
mov ebx, 0x6da6c0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a2d8
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a3d8
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a2bb
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a3d4
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a3d4
mov eax, 1
cmp al, 0
jne 0x40a2bb
mov ecx, edx
jmp 0x40a2bb
xor eax, eax
jmp 0x40a3c4
xor ebx, ebx
jmp 0x40a371
mov ebx, 0x6da6c0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.00450fb0
jmp fcn.0040a250
Function at 0x40a400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a592
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a585
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a585
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a459
mov ebx, 0x5fe6c1
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a540
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a4e3
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x40a491
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x40a48b
cmp esi, dword [esp + 0x18]
je 0x40a4b7
inc ecx
cmp ecx, 8
jb 0x40a46e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x40a467
mov ebx, 0x6da6c0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a48b
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a581
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a467
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a57d
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a57d
mov eax, 1
cmp al, 0
jne 0x40a467
mov edx, ecx
jmp 0x40a467
xor eax, eax
jmp 0x40a56d
xor ebx, ebx
jmp 0x40a51a
mov ebx, 0x6da6c0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call fcn.00450fb0
jmp fcn.0040a400
Function at 0x422490
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4226a3
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x422587
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call fcn.004137f0
mov ebx, 0x6cbae0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040cb50
mov eax, 0x6cbae0
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x422583
cmp byte [0x6d9e38], 0
jne 0x42256d
mov dword [edx], ebp
cmp eax, 0
je 0x422569
cmp byte [0x6d9e38], 0
jne 0x422558
mov dword [eax + 0xc], edx
mov ebx, 0x6cbae0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040cd90
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040f3d0
jmp 0x422540
mov dword [eax], eax
jmp 0x422534
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040f3d0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x42252f
mov dword [edx], eax
jmp 0x422524
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x422649
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.004233e0
mov ebx, 0x6cbae0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040cb50
mov eax, 0x6cbae0
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x422645
cmp byte [0x6d9e38], 0
jne 0x42262f
mov dword [edx], ebp
cmp eax, 0
je 0x42262b
cmp byte [0x6d9e38], 0
jne 0x42261a
mov dword [eax + 0xc], edx
mov ebx, 0x6cbae0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040cd90
jmp 0x422554
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040f3d0
jmp 0x422601
mov dword [eax], eax
jmp 0x4225f5
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040f3d0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x4225f0
mov dword [edx], eax
jmp 0x4225e5
mov ebx, 0x5f8cc3
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.0042a540
mov ebx, 0x5f77af
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x5c4240
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.0040baf0
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call fcn.00429e60
ud2
call fcn.00450fb0
jmp fcn.00422490
Function at 0x423990
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423af1
sub esp, 0x28
mov ebx, 0x6d9d70
mov dword [esp], ebx
call fcn.0040cb50
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call fcn.0042ad20
mov ebx, 0x5f7360
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.0042b730
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.0042b6f0
mov ebx, 0x5f5ae7
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042b730
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0042b5c0
mov ebx, 0x5f5ae5
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042b730
call fcn.0042ada0
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.004485e0
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00452850
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.004528b0
mov edx, dword [esp + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
mov ecx, 0x44d380
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.00450ea0
call fcn.0042ad20
mov ebx, 0x5f5ac6
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b730
call fcn.0042ada0
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, 0x6d9d70
mov dword [esp], ebx
call fcn.0040cd90
add esp, 0x28
ret
call fcn.00450fb0
jmp fcn.00423990
Function at 0x424180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42430c
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x424301
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x4241f4
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x4241df
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x4242f8
cmp ecx, 0x20
jae 0x4242ed
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call fcn.0044b490
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x42427a
jbe 0x424273
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x424201
cmp edx, 0
jb 0x42427a
jmp 0x42426c
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x4242e7
cmp ecx, 0x20
jae 0x4242df
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0044b490
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x424295
xor edx, edx
xor eax, eax
jmp 0x42428b
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x42422a
xor edx, edx
xor eax, eax
jmp 0x42421c
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x4241d5
call fcn.00450fb0
jmp fcn.00424180
Function at 0x431750
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x70]
inc edx
mov dword [ecx + 0x70], edx
mov ecx, 1
mov byte [eax + 0x85], cl
mov ecx, 0xfffffade
mov dword [eax + 8], ecx
mov ebp, dword [eax + 0x18]
mov ebx, dword [ebp + 0x54]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [eax + 0x18]
mov dword [ebp + 0x204], ecx
mov ecx, 1
mov byte [eax + 0x87], cl
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 0x18]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0x14]
inc ecx
mov dword [eax + 0x14], ecx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00452850
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.004528b0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], esi
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x20], esi
xor edx, edx
mov dword [ecx + 0x34], edx
xor edx, edx
mov dword [ecx + 0x30], edx
xor edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], ecx
mov ebp, dword [eax + 0x20]
mov dword [eax + 0x3c], ebp
mov ebp, dword [eax + 0x24]
mov dword [eax + 0x40], ebp
mov edx, dword [eax + 0x3c]
mov ebp, dword [eax]
cmp edx, ebp
jb 0x4318f2
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x3c]
cmp edx, ebp
jb 0x4318f2
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0042d990
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x3c]
mov ebp, dword [ecx]
cmp eax, ebp
jb 0x4318c2
mov eax, dword [ecx + 4]
mov ebp, dword [ecx + 0x3c]
cmp eax, ebp
jb 0x4318c2
mov ebx, 0x619b1c
mov dword [esp], ebx
call fcn.00450ea0
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00452850
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.004528b0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
dec ecx
mov dword [eax + 0x70], ecx
add esp, 0x3c
ret
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov edx, 0x44d9c0
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp], eax
call fcn.00450ea0
jmp 0x431856
mov edi, esi
mov esi, dword [eax + 0x20]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x44d850
mov ebp, dword [esp + 0x14]
mov dword [ecx], ebp
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], eax
mov dword [esp], ecx
call fcn.00450ea0
mov eax, dword [esp + 0x18]
jmp 0x431827