joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542a9d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x542ada
cmp dword [ebp + 0x14], edi
je 0x542ada
cmp ecx, edi
jne 0x542ae1
call fcn.0054b6b3
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.005416c9
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x542af5
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x542b16
cmp ebx, 0xffffffff
je 0x542b05
push ebx
push edi
push ecx
call fcn.0053fd60
add esp, 0xc
cmp esi, edi
je 0x542ac2
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x542ac2
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x542b32
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x542b39
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x542c2a
test word [esi + 0xc], 0x10c
je 0x542b8d
mov eax, dword [esi + 4]
test eax, eax
je 0x542b8d
jl 0x542c8b
cmp ebx, eax
mov edi, ebx
jb 0x542b5e
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x542c32
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0053fac1
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x542c22
cmp ebx, dword [ebp - 0xc]
jb 0x542bfa
cmp dword [ebp - 0xc], 0
je 0x542bb7
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x542bac
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x542bb3
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x542bc2
mov eax, SysReAllocString
cmp ebx, eax
ja 0x542bc2
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x542c5e
push eax
push dword [ebp - 8]
push esi
call fcn.0054591e
pop ecx
push eax
call fcn.00557738
add esp, 0xc
test eax, eax
je 0x542c9d
cmp eax, 0xffffffff
je 0x542c8b
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x542c22
push esi
call fcn.00557057
cmp eax, 0xffffffff
pop ecx
je 0x542c8f
cmp dword [ebp - 4], 0
je 0x542c5e
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x542b41
mov eax, dword [ebp + 0x14]
jmp 0x542adc
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x542c49
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0053fd60
add esp, 0xc
call fcn.0054b6b3
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x542ad2
cmp dword [ebp + 0xc], 0xffffffff
je 0x542c74
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0053fd60
add esp, 0xc
call fcn.0054b6b3
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x542ad2
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x542adc
or dword [esi + 0xc], 0x10
jmp 0x542c8f
Function at 0x551d95
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x60c700]
je 0x551db0
inc edi
cmp edi, 0x17
jb 0x551da1
cmp edi, 0x17
jae 0x551f30
push ebp
push 3
call fcn.0055d72b
cmp eax, 1
pop ecx
je 0x551efc
push 3
call fcn.0055d72b
test eax, eax
pop ecx
jne 0x551de4
cmp dword [0x60bd90], 1
je 0x551efc
cmp ebx, 0xfc
je 0x551f2f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6115b8
push ebp
call fcn.00545032
add esp, 0xc
test eax, eax
je 0x551e1a
push esi
push esi
push esi
push esi
push esi
call fcn.00541595
add esp, 0x14
push 0x104
mov esi, 0x6115d1
push esi
push 0
mov byte [0x6116d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x551e5e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00545032
add esp, 0xc
test eax, eax
je 0x551e5e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00541595
add esp, 0x14
push esi
call fcn.00544ac0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x551ea3
push esi
call fcn.00544ac0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6118cc
push 0x5bde9c
sub ecx, eax
push ecx
push eax
call fcn.00549f90
add esp, 0x14
test eax, eax
je 0x551ea3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00541595
add esp, 0x14
jmp 0x551ea5
xor esi, esi
push 0x5a135c
push ebx
push ebp
call fcn.005468a8
add esp, 0xc
test eax, eax
je 0x551ec5
push esi
push esi
push esi
push esi
push esi
call fcn.00541595
add esp, 0x14
push dword [edi*8 + 0x60c704]
push ebx
push ebp
call fcn.005468a8
add esp, 0xc
test eax, eax
je 0x551ee7
push esi
push esi
push esi
push esi
push esi
call fcn.00541595
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.005696e0
add esp, 0xc
jmp 0x551f2f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x551f2f
cmp ebp, 0xffffffff
je 0x551f2f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x60c704]
push dword [esi]
call fcn.00544ac0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x55d16f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0054e86c
xor ebx, ebx
cmp dword [0x611ad4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x55d245
push 0x5be7e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x55d325
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x55d325
push eax
call fcn.0054e7fe
mov dword [esp], 0x5be7c4
push edi
mov dword [0x611ad4], eax
call esi
push eax
call fcn.0054e7fe
mov dword [esp], 0x5be7b0
push edi
mov dword [0x611ad8], eax
call esi
push eax
call fcn.0054e7fe
mov dword [0x611adc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0054c580
test eax, eax
pop ecx
pop ecx
je 0x55d213
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00541595
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x55d245
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.0054e7fe
cmp eax, ebx
pop ecx
mov dword [0x611ae4], eax
je 0x55d245
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0054e7fe
pop ecx
mov dword [0x611ae0], eax
mov eax, dword [0x611ae0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x55d2ca
cmp dword [0x611ae4], ecx
je 0x55d2ca
push eax
call fcn.0054e875
push dword [0x611ae4]
mov esi, eax
call fcn.0054e875
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x55d2ca
cmp edi, ebx
je 0x55d2ca
call esi
cmp eax, ebx
je 0x55d297
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55d297
test byte [ebp - 0x18], 1
jne 0x55d2ca
lea eax, [ebp - 0x10]
push eax
call fcn.0054c62f
test eax, eax
pop ecx
je 0x55d2b2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00541595
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x55d2c1
or dword [ebp + 0x10], 0x200000
jmp 0x55d305
or dword [ebp + 0x10], 0x40000
jmp 0x55d305
mov eax, dword [0x611ad8]
cmp eax, dword [ebp - 8]
je 0x55d305
push eax
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x55d305
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x55d305
mov eax, dword [0x611adc]
cmp eax, dword [ebp - 8]
je 0x55d305
push eax
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x55d305
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x611ad4]
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x55d325
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55d327
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5696e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0054e86c
xor ebx, ebx
cmp dword [0x611b30], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x5697b6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x569896
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5c479c
push edi
call esi
cmp eax, ebx
je 0x569896
push eax
call fcn.0054e7fe
mov dword [esp], 0x5be7c4
push edi
mov dword [0x611b30], eax
call esi
push eax
call fcn.0054e7fe
mov dword [esp], 0x5be7b0
push edi
mov dword [0x611b34], eax
call esi
push eax
call fcn.0054e7fe
mov dword [0x611b38], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0054c580
test eax, eax
pop ecx
pop ecx
je 0x569784
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00541595
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x5697b6
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0054e7fe
cmp eax, ebx
pop ecx
mov dword [0x611b40], eax
je 0x5697b6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0054e7fe
pop ecx
mov dword [0x611b3c], eax
mov eax, dword [0x611b3c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x56983b
cmp dword [0x611b40], ecx
je 0x56983b
push eax
call fcn.0054e875
push dword [0x611b40]
mov esi, eax
call fcn.0054e875
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x56983b
cmp edi, ebx
je 0x56983b
call esi
cmp eax, ebx
je 0x569808
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x569808
test byte [ebp - 0x18], 1
jne 0x56983b
lea eax, [ebp - 0x10]
push eax
call fcn.0054c62f
test eax, eax
pop ecx
je 0x569823
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00541595
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x569832
or dword [ebp + 0x10], 0x200000
jmp 0x569876
or dword [ebp + 0x10], 0x40000
jmp 0x569876
mov eax, dword [0x611b34]
cmp eax, dword [ebp - 8]
je 0x569876
push eax
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x569876
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x569876
mov eax, dword [0x611b38]
cmp eax, dword [ebp - 8]
je 0x569876
push eax
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x569876
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x611b30]
call fcn.0054e875
cmp eax, ebx
pop ecx
je 0x569896
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x569898
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x57668f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x60bd28]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.005764ee
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0053fd60
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x5766de
cmp dword [ebp - 0x1c], 5
jb 0x5766f6
jmp 0x5766f2
cmp dword [ebp - 0x10], 1
jne 0x5766f6
cmp dword [ebp - 0x1c], 4
ja 0x5766f2
jne 0x5766f6
cmp dword [ebp - 0x18], 0
jbe 0x5766f6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x5c8520
call fcn.005762ab
test eax, eax
jge 0x576717
mov byte [0x60d6e8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0053fab2
add ebp, 0x78
leave
ret

Function at 0x430a6450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x430a645f
pop dword [ebp - 0xc]
mov eax, 0x2c9bdcd8
add eax, 0x166e8787
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x36656
push 0
mov eax, 0x959f4afc
add eax, 0xad6ac5a4
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x6885b56d
sub ecx, 0x68857249
mov edi, eax
mov esi, 0xba8bcb1d
add esi, 0x887f12e3
add esi, dword [ebp - 0xc]
mov ebx, 0xe8fadd87
sub dword [ebp - 4], edx
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 8], edi
mov dword [edi], edx
add dword [ebp - 4], edi
add edi, 0x3a049199
add edi, 0xc5fb6e6b
add esi, 0x330d8ede
sub esi, 0x330d8eda
loop 0x430a64b8
add eax, 0x63dfcf80
add eax, 0x9c212fe3
xor ebx, ebx
add ebx, eax
add eax, 0xca7e7915
add eax, 0x358186f0
mov ecx, 0x17f1db51
add ecx, 0x2b1824af
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000c455
pop dword [ebp - 0x1c]
mov eax, 0x4c234b64
add eax, 0xc3dd78f1
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x37611
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x419d
mov ebx, eax
mov esi, 0x10018600
add esi, dword [ebp - 0x1c]
mov edi, 0x8d6fe6d4
sub edi, 0xe7176ead
add dword [ebp - 0x18], 0x63b6772
mov edx, dword [esi]
sub dword [ebp - 0x10], 0x7789567a
sub edx, edi
xor dword [ebp - 0xc], 0xe65774eb
mov dword [ebx], edx
xor dword [ebp - 8], 0x2ed34ad4
add ebx, 0x54d93f8c
sub ebx, 0x54d93f88
add esi, 0x50052852
add esi, 0xaffad7b2
loop 0x1000c4a3
add eax, 0xb64328a2
sub eax, 0xb6422f5b
mov ebx, eax
add eax, 0x6b2e3ac3
add eax, 0x94d1c542
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4cf106f9
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x47692424
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40fb7e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x5a57de
call fcn.0057798c
mov ebx, ecx
push 0x14
call fcn.00577033
mov esi, dword [ebp + 8]
mov edi, eax
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], eax
xor edi, edi
lea esi, [ebx + 4]
push esi
push edi
push eax
push 0x411404
push edi
push edi
mov dword [ebp - 4], edi
call fcn.0057c540
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x40fbca
mov eax, ebx
call fcn.0057793b
ret 4
push 6
mov dword [esi], edi
call fcn.00562ac5
int3

Function at 0x4139ea
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x413a14
jl 0x413a0b
test ebx, ebx
jne 0x413a14
xor eax, eax
xor edx, edx
jmp 0x413acc
cmp dword [ecx + 0x38], 0
je 0x413a27
push esi
push ebx
push edx
call fcn.0040d126
jmp 0x413acc
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x413a67
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x413a67
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.00578ab0
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x413ac2
call fcn.004141a0
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x413aaa
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00580b01
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x413ac2
jmp 0x413a77
test edx, edx
je 0x413ac2
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.00580b01
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x416661
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
mov dword [edi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi], eax
mov edi, dword [edi]
cmp edi, dword [ebp + 0x10]
je 0x41681b
mov eax, edi
mov dword [ebp - 8], eax
mov ecx, dword [esi]
mov edi, eax
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp + 0x1c]
je 0x41681b
mov edx, dword [ebp + 8]
xor edi, edi
movzx ecx, word [eax]
inc edi
mov eax, ecx
mov byte [ebp + 0x1b], 0
movzx ebx, word [edx]
cmp di, bx
jae 0x4166e6
lea eax, [ecx + 0x2400]
mov edx, 0x3ff
cmp ax, dx
ja 0x41682a
mov eax, ebx
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
xor eax, eax
inc eax
cmp edx, 0x80
jae 0x416709
mov cl, dl
xor ebx, ebx
jmp 0x416738
mov edx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x4166d5
add edx, 0xffff2840
xor eax, eax
shl edx, 0xa
inc eax
mov byte [ebp + 0x1b], al
jmp 0x4166d8
mov ecx, edx
cmp edx, 0x800
jae 0x41671d
shr ecx, 6
mov ebx, eax
or cl, 0xc0
jmp 0x416738
cmp edx, 0x10000
jae 0x41672f
shr ecx, 0xc
or cl, 0xe0
push 2
jmp 0x416737
shr ecx, 0x12
or cl, 0xf0
push 3
pop ebx
movzx eax, byte [ebp + 0x1b]
xor edi, edi
inc edi
xor eax, edi
mov edi, dword [ebp + 0x1c]
add eax, eax
cmp ebx, 3
cmovb eax, ebx
sub edi, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
inc eax
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], eax
jl 0x41681b
mov esi, dword [ebp + 8]
movzx edi, word [esi]
mov esi, dword [ebp + 0x20]
test di, di
jne 0x4167a4
mov edi, dword [ebp - 0x14]
test byte [edi + 0xc], 2
je 0x4167a4
mov edi, dword [ebp - 8]
add eax, 3
cmp dword [ebp - 0xc], eax
jl 0x41681b
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xef
inc dword [esi]
mov eax, dword [esi]
mov byte [eax], 0xbb
inc dword [esi]
mov eax, dword [esi]
mov byte [eax], 0xbf
inc dword [esi]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0x14]
add dword [edi], 2
cmp byte [ebp + 0x1b], 0
jne 0x4167bc
cmp ebx, 3
jb 0x4167bc
mov ecx, dword [esi]
mov dword [ebp - 0x10], ecx
jmp 0x4167ca
mov eax, dword [esi]
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4167f3
mov edi, dword [ebp - 0x10]
imul ecx, ebx, 6
sub ecx, 6
dec eax
mov dword [ebp - 4], eax
mov eax, edx
shr eax, cl
and al, 0x3f
or al, 0x80
mov byte [edi], al
inc dword [esi]
mov eax, dword [ebp - 4]
mov edi, dword [esi]
test eax, eax
jg 0x4167d4
mov edi, dword [ebp + 0x14]
xor eax, eax
shr edx, 0xa
cmp byte [ebp + 0x1b], 0
lea ecx, [eax + 1]
movzx eax, dx
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov edi, dword [edi]
mov eax, edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp + 0x10]
jne 0x41668d
xor eax, eax
cmp dword [ebp + 0xc], edi
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x416823
Function at 0x4196dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x419845
mov eax, ecx
xor ebx, ebx
mov dword [ebp + 0x18], eax
inc ebx
mov edx, dword [ebp + 0x1c]
mov ecx, eax
cmp dword [esi], edx
je 0x419845
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp + 0x23], 0
movzx edi, word [edx]
cmp bx, di
jae 0x41975b
lea eax, [ecx + 0x2400]
mov edx, 0x3ff
cmp ax, dx
ja 0x419854
mov eax, edi
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
mov cl, byte [ebp + 0x23]
cmp edx, 0x80
jae 0x41977d
mov bl, dl
xor edi, edi
jmp 0x4197ad
mov edx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x41974a
add edx, 0xffff2840
mov cl, bl
shl edx, 0xa
mov byte [ebp + 0x23], cl
jmp 0x41974d
mov ebx, edx
cmp edx, 0x800
jae 0x419792
shr ebx, 6
xor edi, edi
or bl, 0xc0
inc edi
jmp 0x4197ad
cmp edx, 0x10000
jae 0x4197a4
shr ebx, 0xc
or bl, 0xe0
push 2
jmp 0x4197ac
shr ebx, 0x12
or bl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp + 0x18]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 8], eax
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 4]
jl 0x419845
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp + 0x23], 0
mov dword [ecx], eax
jne 0x4197e9
cmp edi, 3
jb 0x4197e9
mov ebx, dword [ebp - 4]
jmp 0x4197f2
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov ebx, dword [ebp - 8]
mov eax, dword [esi]
mov dword [ebp + 0x18], eax
test ebx, ebx
je 0x41981a
imul ecx, edi, 6
mov edi, dword [ebp + 0x18]
sub ecx, 6
mov eax, edx
dec ebx
shr eax, cl
and al, 0x3f
or al, 0x80
mov byte [edi], al
inc dword [esi]
mov eax, dword [esi]
mov dword [ebp + 0x18], eax
test ebx, ebx
jg 0x4197fe
xor ebx, ebx
shr edx, 0xa
inc ebx
movzx eax, dx
cmp byte [ebp + 0x23], 0
mov ecx, ebx
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp + 0x18], eax
cmp ecx, dword [ebp + 0x10]
jne 0x419708
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x41984d