joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dbcf
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes

Disassembly:
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42dbe2
test al, 0x10
jne 0x42dbf3
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42dbf3
ret
jmp fcn.0042d987

Function at 0x42dc74
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x42dcd9
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42dcb7
xor edi, edi
jmp 0x42dccd
push 1
push esi
push esi
push dword [ebp - 4]
call fcn.004b1b80
mov edi, eax
xor eax, eax
mov esi, edx
add edi, ebx
adc esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
jmp 0x42dcdf
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret
Function at 0x42de5e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push edi
call fcn.0044d954
push dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.004af6d0
lea esi, [ebp - 0x118]
call fcn.0042d95e
lea eax, [ebp - 0x118]
push 0x50592c
push eax
call fcn.004af6e0
add esp, 0x18
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x42e052
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x22c]
push 0x505928
shr esi, 4
push eax
and esi, 1
call fcn.004b15d0
test eax, eax
pop ecx
pop ecx
je 0x42e023
lea eax, [ebp - 0x22c]
push 0x505924
push eax
call fcn.004b15d0
test eax, eax
pop ecx
pop ecx
je 0x42e023
xor eax, eax
cmp dword [ebp + 0x10], eax
sete al
xor eax, esi
je 0x42e023
push dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.004af6d0
lea esi, [ebp - 0x118]
call fcn.0042d95e
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004af6e0
lea eax, [ebp - 0x118]
push eax
call fcn.004af4f0
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0044baa5
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422a64
add esp, 0x38
inc ebx
jmp 0x42e023
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x22c]
push 0x505928
shr esi, 4
push eax
and esi, 1
call fcn.004b15d0
test eax, eax
pop ecx
pop ecx
je 0x42e023
lea eax, [ebp - 0x22c]
push 0x505924
push eax
call fcn.004b15d0
test eax, eax
pop ecx
pop ecx
je 0x42e023
xor eax, eax
cmp dword [ebp + 0x10], eax
sete al
xor eax, esi
je 0x42e023
push dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.004af6d0
lea esi, [ebp - 0x118]
call fcn.0042d95e
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004af6e0
lea eax, [ebp - 0x118]
push eax
call fcn.004af4f0
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0044baa5
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00422a64
add esp, 0x38
inc ebx
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42df78
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 8]
push dword [ebp - 4]
mov eax, ebx
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
leave
ret
Function at 0x42e0ec
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push edi
push dword [ebp + 8]
xor ebx, ebx
call fcn.0044d954
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
call fcn.004af6d0
lea esi, [ebp - 0x118]
call fcn.0042d95e
lea eax, [ebp - 0x118]
push 0x50952c
push eax
call fcn.004af6e0
add esp, 0x18
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x42e24d
test byte [ebp - 0x258], 0x10
jne 0x42e21e
mov esi, dword [ebp + 0x14]
push 0x104
lea eax, [ebp - 0x460]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebp + eax*2 - 0x462], di
mov eax, esi
cmp word [eax], di
je 0x42e21e
lea eax, [ebp - 0x460]
mov ecx, esi
call fcn.0042e056
test eax, eax
jne 0x42e1b9
push esi
call fcn.004b15b4
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
pop ecx
jne 0x42e196
jmp 0x42e21e
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
call fcn.004af6d0
lea esi, [ebp - 0x118]
call fcn.0042d95e
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004af6e0
lea eax, [ebp - 0x118]
push eax
call fcn.004af4f0
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0044baa5
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00422a64
add esp, 0x38
inc ebx
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42e156
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + 8]
push dword [ebp - 4]
mov eax, ebx
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e252
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
push 0x509544
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x42e2ed
push str.GetDiskFreeSpaceExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x42e2ed
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x42e2ed
mov eax, dword [ebp + 0x10]
sub eax, edi
je 0x42e2d4
dec eax
je 0x42e2c7
dec eax
dec eax
mov eax, dword [ebp + 0xc]
je 0x42e2bd
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x42e2e8
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
jmp 0x42e2b8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
jmp 0x42e2b8
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor esi, esi
inc esi
jmp 0x42e355
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x42e353
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
sub eax, edi
mov dword [esi + 4], edx
je 0x42e33a
dec eax
je 0x42e32f
dec eax
dec eax
je 0x42e32f
push edx
push dword [esi]
push edi
push dword [ebp - 4]
jmp 0x42e347
push dword [esi + 4]
push dword [esi]
push edi
push dword [ebp - 8]
jmp 0x42e347
push dword [esi + 4]
mov eax, dword [ebp - 4]
push dword [esi]
sub eax, dword [ebp - 8]
push edi
push eax
call fcn.004b1b80
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x42e2e8
xor esi, esi
cmp ebx, edi
je 0x42e360
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4309eb
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x509b8c
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
lea edi, [esi + 0x24]
mov dword [edi], eax
je 0x430b4a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x509b7c
push eax
call ebx
test eax, eax
mov dword [esi + 0x28], eax
je 0x430b2d
push 0x509b68
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x34], eax
je 0x430b2d
push 0x509b54
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x38], eax
je 0x430b2d
push str.InternetSetOptionA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x30], eax
je 0x430b2d
push 0x509b2c
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x2c], eax
je 0x430b2d
push str.FtpFindFirstFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x3c], eax
je 0x430b2d
push str.FtpOpenFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x40], eax
je 0x430b2d
push str.FtpGetCurrentDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x44], eax
je 0x430b2d
push str.FtpSetCurrentDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x48], eax
je 0x430b2d
push str.FtpCreateDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x4c], eax
je 0x430b2d
push str.FtpRemoveDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x50], eax
je 0x430b2d
push str.FtpDeleteFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x54], eax
je 0x430b2d
push str.FtpRenameFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x58], eax
je 0x430b2d
push str.InternetFindNextFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x5c], eax
je 0x430b2d
push 0x509a64
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x60], eax
je 0x430b2d
push str.FtpGetFileSize
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x64], eax
jne 0x430b46
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
push 0
push edi
call fcn.004af490
add esp, 0xc
xor eax, eax
jmp 0x430b49
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
ret
Function at 0x439527
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x500364
call fcn.004af370
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
xor edx, edx
test eax, eax
jbe 0x439566
movzx ebx, byte [edx + esi]
mov edi, ecx
shr edi, 9
xor edi, ecx
shr edi, 7
xor edi, ebx
shl ecx, 5
xor ecx, edi
inc edx
cmp edx, eax
jb 0x43954c
mov eax, ecx
mov edi, 0xbf
xor edx, edx
mov ecx, edi
div ecx
mov esi, edx
add esi, 0xb798
mov dword [ebp - 0x10], esi
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov ebx, 0x556a60
jmp 0x4395a8
add esi, edi
cmp esi, 0xd2ef
mov dword [ebp - 0x10], esi
ja 0x4395c3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00439322
test eax, eax
jne 0x43959b
cmp esi, 0xd2ef
jb 0x439609
mov esi, 0xd2f0
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.00439322
test eax, eax
je 0x439609
inc esi
cmp esi, 0xdea7
mov dword [ebp - 0x10], esi
jb 0x4395cb
or esi, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401711
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x14], 0
test edi, edi
je 0x439680
cmp byte [edi], 0
je 0x439680
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x439680
push edi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00406a9c
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.004f0b90
mov eax, dword [eax + 8]
push 0x10
push 0x10
push 0x10
push 1
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ecx, dword [ebp - 0x1c]
and byte [ebp - 4], 0
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0040141b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0043934d
mov ecx, eax
call fcn.00439307
jmp 0x4395ed
Function at 0x441a99
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bx, word [ebp + 8]
push esi
xor esi, esi
cmp bx, si
jne 0x441abe
push str.None
push dword [ebp + 0xc]
call fcn.004af6d0
pop ecx
pop ecx
jmp 0x441b3e
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
test byte [eax + 0x54f834], bh
je 0x441afd
test esi, esi
je 0x441ad9
mov byte [esi + edi], 0x2b
inc esi
mov ebx, dword [ebp - 4]
lea ebx, [ebx + 0x54f838]
push dword [ebx]
lea eax, [esi + edi]
push eax
call fcn.004af6d0
push dword [ebx]
call fcn.004af4f0
mov bx, word [ebp + 8]
add esp, 0xc
add esi, eax
add dword [ebp - 4], 8
cmp dword [ebp - 4], 0x18
jb 0x441ac5
test bl, bl
je 0x441b3d
test esi, esi
je 0x441b14
mov byte [esi + edi], 0x2b
inc esi
movzx eax, bl
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebx, bh
and ebx, 8
shl ebx, 5
push 0x80
or eax, ebx
add esi, edi
shl eax, 0x10
push esi
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44428c
Capabilities:
Set socket configuration

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [ecx + 4]
call sub.WSOCK32.dll_setsockopt
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 0x10
Function at 0x449b8a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push ebx
push esi
mov esi, dword [eax + 8]
mov edx, esi
xor ebx, ebx
or edx, ecx
push edi
jne 0x449bb0
call fcn.00418165
mov ebx, eax
jmp 0x449cdb
lea edx, [eax + 0x10]
mov edi, dword [edx]
cmp edi, 4
jne 0x449c0c
cmp esi, 1
jne 0x449bc3
test ecx, ecx
je 0x449bd8
test ecx, ecx
jl 0x449d01
jg 0x449bd2
cmp esi, 2
jb 0x449c0c
cmp dword [eax + 0x20], 4
je 0x449c0c
push edx
push dword [ebp + 8]
call fcn.0044ba59
pop ecx
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x449c00
push 0x50c16c
push esi
call fcn.004b15a1
pop ecx
pop ecx
mov ebx, eax
push esi
call fcn.004183b6
pop ecx
jmp 0x449cdb
test ecx, ecx
jl 0x449d01
jg 0x449c1f
cmp esi, 2
jb 0x449d01
cmp edi, 4
jne 0x449d01
lea esi, [eax + 0x20]
cmp dword [esi], edi
jne 0x449d01
push edx
push dword [ebp + 8]
call fcn.0044ba59
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0044ba59
mov edi, eax
push edi
call fcn.004af4f0
inc eax
inc eax
push eax
push 1
push dword [ebp + 8]
call fcn.00418324
and dword [ebp - 8], 0
and dword [ebp + 0x10], 0
mov ebx, eax
push edi
mov dword [ebp - 4], ebx
call fcn.004af4f0
add esp, 0x24
test eax, eax
jbe 0x449cab
mov esi, edi
sub ebx, edi
mov al, byte [esi]
cmp al, 0x62
je 0x449c8a
cmp al, 0x74
je 0x449c8a
mov byte [ebx + esi], al
jmp 0x449c95
mov byte [ebx + esi], 0x62
mov dword [ebp - 8], 1
inc dword [ebp + 0x10]
push edi
inc esi
call fcn.004af4f0
cmp dword [ebp + 0x10], eax
pop ecx
jb 0x449c7b
cmp dword [ebp - 8], 0
jne 0x449cb5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 0x62
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.004b15a1
push dword [ebp - 0xc]
mov ebx, eax
call fcn.004183b6
push edi
call fcn.004183b6
push dword [ebp - 4]
call fcn.004183b6
add esp, 0x14
test ebx, ebx
je 0x449d01
push 4
push 1
push dword [ebp + 8]
call fcn.00418324
push eax
push dword [ebp + 0xc]
mov dword [eax], ebx
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0049beee
add esp, 0x1c
jmp 0x449d0a
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44bde0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x100
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xf
push dword [ebp - 4]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebx
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
push 0x1f4
call ebx
rdtsc
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x14]
push dword [ebp - 4]
call edi
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
fild dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
test eax, eax
jge 0x44be77
fadd qword [0x504a40]
fmul qword [0x50c4b0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450266
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x450274
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x450348
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50cb30]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50cb30]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50cb30]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50cb30]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50cb30]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50cb30]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50cb30]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50cb30]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x450291
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x450368
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x50cb30]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x45034e
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x4508bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov ecx, dword [edi + 0x64]
mov eax, dword [edi + 0x34]
mov edx, dword [edi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
jne 0x4508e2
test ecx, ecx
jne 0x4508ec
test edx, edx
jne 0x4508ec
mov eax, ebx
jmp 0x450958
cmp eax, 0xffffffff
jne 0x4508ec
push 0xfffffffffffffffe
pop eax
jmp 0x450958
mov edx, dword [edi + 0x24]
lea edx, [ebx + edx - 0x106]
cmp ecx, edx
jb 0x450958
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004aebe0
mov ecx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov esi, edx
sub esi, ebx
cmp edx, ebx
sbb edx, edx
not edx
and edx, esi
dec ecx
mov word [eax], dx
jne 0x45091d
mov eax, dword [edi + 0x38]
mov edx, ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov esi, ecx
sub esi, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, esi
dec edx
mov word [eax], cx
jne 0x45093c
mov eax, dword [ebp - 4]
add eax, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x4509b1
push eax
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push eax
call fcn.004506a9
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
cmp esi, 3
pop ecx
pop ecx
jb 0x45099d
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x4509b1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4508c4
pop esi
pop ebx
leave
ret

Function at 0x4521f2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 5
pop edi
jae 0x452230
cmp dword [ebp - 0x18], 4
jne 0x45222c
cmp dword [ebp - 0x14], 0x5a
jae 0x452230
push 0x4c
jmp 0x452232
push 0x58
pop eax
add ebp, 0x78
leave
ret
Function at 0x45ee8b
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x45eeb8
push esi
call fcn.00463592
cmp byte [esi + 0x40], 0
pop ecx
je 0x45eeb1
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45ef27
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x45ef1c
mov eax, dword [esi + 8]
test eax, eax
je 0x45eed9
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x45ef18
cmp eax, 2
je 0x45ef1c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45eece
cmp eax, 3
je 0x45eefd
cmp eax, 1
jne 0x45eece
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x45eece
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45eece
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x45ef45
cmp eax, 0xcc
je 0x45ef45
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.0045ed5e
pop esi
ret