joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45637a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4936d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45644f
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45643e
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x456428
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x45643e
push eax
push edi
push dword [ebp - 0x110]
call fcn.00456317
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x456451
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bc1b
leave
ret 4
Function at 0x457690
Capabilities:
Resume thread

Disassembly:
sub esp, 8
mov ecx, dword [0x499318]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x14], eax
lea ebp, [eax + 1]
test ecx, ecx
je 0x45774e
mov dword [esp + 0x10], eax
jmp 0x4576d0
mov dword [0x4992fc], ebp
mov edx, dword [0x499318]
push 2
push edx
call esi
mov eax, dword [0x499318]
push eax
call edi
mov ecx, dword [0x499318]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x45770d
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x4576d0
cmp dword [esp + 0x10], 0x1e
jne 0x457729
push str.02100901:_Timeout_Error:_adxm_destroy_thrd__vsync_
call fcn.00461c20
add esp, 4
mov dword [esp + 0x14], 0xffffffff
xor eax, eax
mov dword [0x499300], eax
mov dword [0x4992fc], eax
mov edx, dword [0x499318]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x499314], eax
mov dword [0x499318], eax
mov ecx, dword [0x499320]
test ecx, ecx
je 0x4577da
mov dword [esp + 0x10], eax
mov dword [0x499304], ebp
mov edx, dword [0x499320]
push 2
push edx
call esi
mov eax, dword [0x499320]
push eax
call edi
mov ecx, dword [0x499320]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x45779d
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x457760
cmp dword [esp + 0x10], 0x1e
jne 0x4577b5
push str.02100902:_Timeout_Error:_ADXWIN_DisableFsThrd
call fcn.00461c20
add esp, 4
sub dword [esp + 0x14], ebp
xor eax, eax
mov dword [0x499308], eax
mov dword [0x499304], eax
mov edx, dword [0x499320]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x49931c], eax
mov dword [0x499320], eax
mov ecx, dword [0x499328]
test ecx, ecx
je 0x45786c
mov dword [esp + 0x10], eax
lea esp, [esp]
mov dword [0x49930c], ebp
mov edx, dword [0x499328]
push 2
push edx
call esi
mov eax, dword [0x499328]
push eax
call edi
mov ecx, dword [0x499328]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x45782d
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x4577f0
cmp dword [esp + 0x10], 0x1e
jne 0x457845
push str.02100903:_Timeout_Error:_adxm_destroy_thrd__mwidle_
call fcn.00461c20
add esp, 4
sub dword [esp + 0x14], ebp
xor esi, esi
mov dword [0x499310], esi
mov dword [0x49930c], esi
mov edx, dword [0x499328]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x499324], esi
mov dword [0x499328], esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x457a30
Capabilities:
Create thread

Disassembly:
push 0x499314
push 4
push 0
push 0x457990
push 0x100000
push 0
call fcn.0043fe89
mov dword [0x499318], eax
mov eax, dword [0x499318]
add esp, 0x18
test eax, eax
jne 0x457a6c
push str.E02100911_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461c20
add esp, 4
or eax, 0xffffffff
ret
push 0x49931c
push 4
push 0
push 0x4579f0
push 0x100000
push 0
call fcn.0043fe89
mov dword [0x499320], eax
mov ecx, dword [0x499320]
add esp, 0x18
test ecx, ecx
jne 0x457aa9
push str.E02100912_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461c20
add esp, 4
or eax, 0xffffffff
ret
push 0x499324
push 4
push 0
push 0x4575e0
push 0x100000
push 0
call fcn.0043fe89
mov dword [0x499328], eax
mov edx, dword [0x499328]
add esp, 0x18
test edx, edx
jne 0x457ae6
push str.E02100913_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461c20
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x457af0
Capabilities:
Resume thread

Disassembly:
push esi
push 0x4992d4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x457bee
push edi
xor edi, edi
mov dword [0x4992fc], edi
mov dword [0x499300], edi
mov dword [0x49930c], edi
mov dword [0x499310], edi
mov dword [0x4992e8], edi
call fcn.0045fe00
push edi
push edi
call fcn.0045fd00
push edi
push edi
call fcn.0045fd20
push 0x457540
call fcn.0045fea0
add esp, 0x14
cmp esi, edi
jne 0x457b6c
mov dword [0x4992d8], 2
mov dword [0x4992dc], 1
mov dword [0x4992e0], 0xfffffff1
jmp 0x457b85
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [0x4992d8], eax
mov dword [0x4992dc], ecx
mov dword [0x4992e0], edx
call fcn.00457a30
test eax, eax
jge 0x457b9a
call fcn.00457690
pop edi
pop esi
jmp fcn.0045fe60
call fcn.00457880
test eax, eax
jge 0x457baf
call fcn.00457690
pop edi
pop esi
jmp fcn.0045fe60
mov eax, dword [0x4992dc]
push eax
call fcn.00462270
mov ecx, dword [0x499318]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
add esp, 4
push ecx
call esi
mov edx, dword [0x499320]
push edx
call esi
mov eax, dword [0x499328]
push eax
call esi
push edi
push 0x457560
push 6
call fcn.00460160
add esp, 0xc
pop edi
pop esi
ret
Function at 0x4588a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0046d59e
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call esi
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
lea edx, [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x14]
push 0
push 0xf4240
push ecx
push eax
call fcn.004402d0
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.00440310
push 0xa
mov edi, eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call esi
xor ebp, ebp
push ebp
push 0xa
push ebx
push edi
call fcn.00440310
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
call fcn.0046d5b0
lea eax, [esp + 0x18]
push eax
call esi
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, edi
sub ecx, dword [esp + 0x10]
push 0
mov edx, ebx
sbb edx, dword [esp + 0x18]
push 0xf4240
push edx
push ecx
call fcn.004402d0
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.00440310
cmp edx, dword [esp + 0x2c]
jl 0x4589d8
jg 0x4589c3
cmp eax, dword [esp + 0x28]
jb 0x4589d8
inc ebp
cmp ebp, 0x80
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
jl 0x458953
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x466ee0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x14
xor eax, eax
push esi
test ecx, ecx
jle 0x466f0a
mov esi, dword [str.fmt]
mov esi, dword [esi]
lea ebx, [ebx]
cmp dword [eax + edx], esi
je 0x466f0a
inc eax
cmp eax, ecx
jl 0x466f00
cmp eax, ecx
jne 0x466f16
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
mov esi, dword [eax + edx + 0xc]
push ebx
mov ebx, dword [eax + edx + 0x10]
push edi
mov edi, dword [eax + edx + 8]
cmp di, 1
mov dword [esp + 0x14], ebx
mov ebx, dword [eax + edx + 0x14]
mov eax, dword [eax + edx + 0x18]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
jg 0x466f5e
xor eax, eax
test ecx, ecx
jle 0x466f5a
mov edi, dword [str.data]
mov edi, dword [edi]
cmp dword [eax + edx], edi
je 0x466f5a
inc eax
cmp eax, ecx
jl 0x466f50
cmp eax, ecx
jne 0x466f68
pop edi
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
movzx ecx, byte [eax + edx + 7]
movzx edi, byte [eax + edx + 6]
shl ecx, 8
or ecx, edi
movzx edi, byte [eax + edx + 5]
movzx edx, byte [eax + edx + 4]
shl ecx, 8
or ecx, edi
mov edi, dword [esp + 0x3c]
add eax, 8
shl ecx, 8
or ecx, edx
mov edx, dword [esp + 0x2c]
mov word [edx], ax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
mov byte [eax], 0xff
movzx eax, byte [esp + 0xe]
mov dword [edx], esi
mov esi, dword [esp + 0x34]
mov dl, byte [esp + 0x1a]
mov byte [edi], al
mov byte [esi], dl
push ebp
mov ebp, dword [esp + 0x3c]
mov byte [ebp], bl
movsx ebx, bl
mov eax, ecx
cdq
idiv ebx
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [ebx], eax
mov dword [edx], 1
mov al, byte [esi]
cmp al, 0x10
jne 0x466fe8
mov ecx, dword [esp + 0x50]
xor eax, eax
mov word [ecx], ax
jmp 0x467022
cmp al, 8
jne 0x466ff3
mov edx, 1
jmp 0x46701b
cmp al, 4
jne 0x467022
mov al, byte [edi]
add al, al
mov byte [ebp], al
mov dword [edx], 4
mov eax, ecx
movsx ecx, byte [edi]
cdq
sub eax, edx
sar eax, 1
cdq
idiv ecx
mov edx, 2
mov dword [ebx], eax
mov byte [esi], 0x10
mov eax, dword [esp + 0x50]
mov word [eax], dx
cmp byte [esi], 0
je 0x46704c
cmp byte [ebp], 0
je 0x46704c
mov al, byte [edi]
test al, al
jle 0x46704c
cmp al, 2
jg 0x46704c
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx]
neg eax
pop ebp
sbb eax, eax
pop edi
neg eax
pop ebx
dec eax
pop esi
add esp, 0x14
ret
pop ebp
pop edi
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x467a10
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
test eax, eax
je 0x467a55
mov edi, dword [esp + 0xc]
test edi, edi
je 0x467a55
push esi
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x467a44
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x467a44
pop esi
xor eax, eax
pop edi
ret
mov edx, dword [esp + 0xc]
mov dword [edi], esi
pop esi
mov dword [edi + 4], edx
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x468080
Capabilities:
Create thread

Disassembly:
push ecx
test eax, eax
jne 0x468096
push str.NULL_pointer_is_passed.
call fcn.00461c20
add esp, 4
xor eax, eax
pop ecx
ret
cmp dword [esp + 8], 0x50
jae 0x4680ae
push str.Work_area_size_is_too_short.
call fcn.00461c20
add esp, 4
xor eax, eax
pop ecx
ret
push esi
lea esi, [eax + 3]
push 0x4c
and esi, 0xfffffffc
push 0
push esi
call fcn.0043ecf0
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4680e9
push str.E2004112601_:_Can_not_create_wait_event.
call fcn.00461c20
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esi + 0x14]
push 0x1c
push eax
call fcn.004652e0
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
jne 0x46811a
push str.E2004112602_:_Can_not_create_critical_section.
call fcn.00461c20
mov ecx, dword [esi + 0xc]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x467ff0
push 0
push 0
call fcn.0043fe89
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
jne 0x468162
push str.E2004112603_:_Can_not_create_thread.
call fcn.00461c20
mov eax, dword [esi + 0xc]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004653e0
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
cmp dword [esi + 0x3c], 0
jne 0x46817b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0xa
call edi
cmp dword [esi + 0x3c], 0
je 0x468170
pop edi
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0xffffffff
mov dword [esi], 1
mov eax, esi
pop esi
pop ecx
ret

Function at 0x46a0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov al, byte [esi + ecx + 1]
push edi
xor edi, edi
mov dword [esp + 8], edi
mov byte [esp + 5], al
test al, 6
je 0x46a0bd
xor eax, eax
pop edi
add esp, 8
ret
mov dl, byte [esi + ecx + 2]
mov byte [esp + 7], dl
and dl, 0xc0
cmp dl, 0x40
jne 0x46a0b6
push ebx
push ebp
mov ebp, dword [esp + 0x18]
add ebp, 0xfffffff8
cmp ecx, ebp
jge 0x46a163
movzx edx, byte [esi + ecx]
mov byte [esp + 0xe], dl
mov dl, byte [esi + ecx + 3]
jmp 0x46a0f4
mov al, byte [esp + 0xd]
mov bl, byte [esp + 0xe]
cmp bl, byte [ecx + esi]
jne 0x46a102
mov edi, 1
cmp al, byte [esi + ecx + 1]
jne 0x46a109
inc edi
mov al, byte [esp + 0xf]
cmp al, byte [esi + ecx + 2]
jne 0x46a114
inc edi
mov al, byte [esi + ecx + 3]
cmp dl, al
je 0x46a125
mov bl, dl
xor bl, al
test bl, 0xf0
jne 0x46a126
inc edi
cmp edi, 4
jl 0x46a163
mov edi, dword [esp + 0x10]
inc edi
cmp edi, 3
mov dword [esp + 0x10], edi
jge 0x46a16c
movzx edi, byte [ecx + esi + 4]
movzx eax, al
and eax, 3
shl eax, 8
or eax, edi
movzx edi, byte [ecx + esi + 5]
add eax, eax
add eax, eax
add eax, eax
shr edi, 5
or eax, edi
jle 0x46a163
add ecx, eax
xor edi, edi
cmp ecx, ebp
jl 0x46a0f0
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 8
ret
Function at 0x46a950
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push edi
mov ebp, 0xfffffff4
test ecx, ecx
je 0x46ab05
mov edi, dword [esp + 0x20]
test edi, edi
jle 0x46ab05
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x46ab05
lea eax, [edi - 0xc]
cmp eax, ebp
push esi
jle 0x46aaf0
jmp 0x46a994
mov edi, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov edx, edi
call fcn.0046a820
mov ebp, eax
test ebp, ebp
jl 0x46aafa
lea eax, [ebp + 0xc]
push edi
call fcn.0046a870
push edi
mov esi, eax
call fcn.0046a8e0
mov edi, eax
add esp, 8
test edi, edi
jge 0x46a9cd
mov eax, dword [esp + 0x24]
add eax, 0xfffffff4
cmp ebp, eax
jl 0x46a990
mov dword [ebx], 5
lea eax, [esi + ecx + 0xb]
mov dword [esp + 0x20], eax
movzx eax, byte [eax]
shl eax, 8
lea edx, [esi + ecx + 0xa]
mov dword [esp + 0x10], edx
movzx edx, byte [edx]
or eax, edx
mov dword [ebx + 8], eax
movzx eax, byte [esi + ecx + 0xf]
movzx edx, byte [esi + ecx + 0xe]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0xd]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0xc]
shl eax, 8
or eax, edx
mov dword [ebx + 4], eax
movzx eax, byte [esi + ecx + 0x13]
movzx edx, byte [esi + ecx + 0x12]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0x11]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0x10]
shl eax, 8
or eax, edx
add eax, eax
add eax, eax
add eax, eax
mov dword [ebx + 0x28], eax
movzx eax, byte [esi + ecx + 0x17]
lea edx, [esi + ecx + 0x17]
shl eax, 8
lea esi, [esi + ecx + 0x16]
mov dword [esp + 0x14], esi
movzx esi, byte [esi]
or eax, esi
mov esi, dword [esp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x20]
movzx eax, byte [eax]
movzx esi, byte [esi]
shl eax, 8
or eax, esi
mov esi, dword [esp + 0x14]
movzx esi, byte [esi]
mov dword [esp + 0x18], edx
movzx edx, byte [edx]
shl edx, 8
or edx, esi
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x2c], eax
movzx eax, byte [edi + ecx + 7]
movzx edx, byte [edi + ecx + 6]
shl eax, 8
or eax, edx
movzx edx, byte [edi + ecx + 5]
movzx ecx, byte [edi + ecx + 4]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x20]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx]
mov edx, dword [esp + 0x10]
movzx edx, byte [edx]
shl ecx, 8
or ecx, edx
cdq
idiv ecx
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx]
mov edx, dword [esp + 0x14]
movzx edx, byte [edx]
shl ecx, 8
or ecx, edx
cdq
idiv ecx
add eax, eax
add eax, eax
add eax, eax
cdq
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
Function at 0x46acb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x20]
movsx eax, word [ecx + 2]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x20], eax
xor eax, eax
push edi
movsx edi, word [ecx]
mov dword [esp + 0x1c], eax
test esi, esi
jle 0x46ae32
mov ebx, dword [esp + 0x2c]
jmp 0x46ace6
mov edx, dword [esp + 0x10]
movzx ecx, word [edx]
mov ebp, dword [esp + 0x3c]
mov esi, ecx
sar esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
movzx esi, si
test esi, 0x8000
jne 0x46ae40
movzx ecx, word [ebp]
mov eax, ecx
imul ecx, dword [esp + 0x40]
add ecx, dword [esp + 0x44]
xor eax, esi
and eax, 0x1fff
inc eax
movzx esi, ax
movsx eax, word [esp + 0x34]
and ecx, 0x7fff
mov word [ebp], cx
movsx ebp, word [esp + 0x38]
movsx ecx, si
add edx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0x10
jmp 0x46ad54
mov edx, dword [esp + 0x10]
movsx esi, byte [edx]
inc edx
mov dword [esp + 0x10], edx
mov edx, eax
imul edx, edi
mov eax, ebp
imul eax, dword [esp + 0x24]
mov ecx, esi
sar ecx, 4
imul ecx, dword [esp + 0x14]
add edx, eax
sar edx, 0xc
add edx, ecx
cmp edx, 0x7fff
jg 0x46ad90
cmp edx, 0xffff8000
jge 0x46ada4
mov edx, 0xffff8000
jmp 0x46ada4
cmp edx, 0xffff8000
jge 0x46ad9f
mov edx, 0xffff8000
jmp 0x46ada4
mov edx, 0x7fff
movsx eax, word [esp + 0x34]
mov word [ebx], dx
mov dword [esp + 0x24], edx
mov ecx, eax
imul ecx, edx
mov edx, ebp
imul edx, edi
add ecx, edx
and esi, 0xf
mov edx, dword [esi*4 + 0x47e328]
imul edx, dword [esp + 0x14]
sar ecx, 0xc
add ecx, edx
add ebx, 2
cmp ecx, 0x7fff
jg 0x46adea
cmp ecx, 0xffff8000
jge 0x46adfe
mov ecx, 0xffff8000
jmp 0x46adfe
cmp ecx, 0xffff8000
jge 0x46adf9
mov ecx, 0xffff8000
jmp 0x46adfe
mov ecx, 0x7fff
mov edx, dword [esp + 0x24]
mov word [ebx], cx
add ebx, 2
sub dword [esp + 0x18], 1
mov dword [esp + 0x24], edx
mov edi, ecx
jne 0x46ad50
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
inc eax
cmp eax, esi
mov dword [esp + 0x1c], eax
jl 0x46ace2
mov ecx, dword [esp + 0x30]
mov ax, word [esp + 0x24]
mov word [ecx + 2], ax
mov word [ecx], di
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], eax
call fcn.00401298
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x41b5c8]
add ebx, 0x23f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov ecx, dword [0xae36e4]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132c
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 4]
mov ecx, dword [0xae36e4]
add eax, dword [ebp - 0x28]
mov edx, 0xedeb2e40
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
mov eax, dword [0xae36e0]
cmove eax, edx
xor edx, edx
mov dword [0xae36e0], eax
cmp ecx, 0x3eb
mov eax, dword [0xae3638]
cmove eax, edx
mov dword [0xae3638], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], edx
mov dword [0xae36dc], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [ebp - 0x18], esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 4]
add ebx, 0x61c88647
shr edx, cl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
xor edx, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x10], ebx
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
jne 0x4012fa
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret