joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42826c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x428284
mov edi, dword [esi + 0xc]
jmp 0x4282c4
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42829d
call fcn.00420074
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4282b2
call fcn.00420074
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4282c4
call fcn.00420074
call fcn.0041fe6a
cmp dword [eax + 0x3c], 0
je 0x4282d9
push edi
mov ecx, ebx
call fcn.0042706d
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00428192
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4282f7
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x428303
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x429eac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x429ef4
call fcn.0041fe6a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x429ef4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x429f37
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x429f20
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x429f20
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x429f34
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43bb40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4936d0]
jne 0x43bb4a
repz ret
jmp fcn.00441f7e
Function at 0x44cef2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004418e2
and dword [ebp - 4], 0
cmp dword [0x498fa0], 0
mov ebx, eax
jne 0x44cfa3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44d054
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x44d054
push eax
call fcn.00441870
mov dword [esp], 0x478b8c
push edi
mov dword [0x498fa0], eax
call esi
push eax
call fcn.00441870
mov dword [esp], 0x478b78
push edi
mov dword [0x498fa4], eax
call esi
push eax
call fcn.00441870
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x498fa8], eax
call esi
push eax
call fcn.00441870
pop ecx
mov dword [0x498fb0], eax
test eax, eax
je 0x44cfa3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00441870
pop ecx
mov dword [0x498fac], eax
mov eax, dword [0x498fac]
cmp eax, ebx
je 0x44cffb
cmp dword [0x498fb0], ebx
je 0x44cffb
push eax
call fcn.004418eb
push dword [0x498fb0]
mov esi, eax
call fcn.004418eb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44cffb
test edi, edi
je 0x44cffb
call esi
test eax, eax
je 0x44cff2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44cff2
test byte [ebp - 0xc], 1
jne 0x44cffb
or dword [ebp + 0x10], 0x200000
jmp 0x44d034
mov eax, dword [0x498fa4]
cmp eax, ebx
je 0x44d034
push eax
call fcn.004418eb
pop ecx
test eax, eax
je 0x44d034
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44d034
mov eax, dword [0x498fa8]
cmp eax, ebx
je 0x44d034
push eax
call fcn.004418eb
pop ecx
test eax, eax
je 0x44d034
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x498fa0]
call fcn.004418eb
pop ecx
test eax, eax
je 0x44d054
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44d056
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4562bc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4936d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x456391
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x456380
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x45636a
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x456380
push eax
push edi
push dword [ebp - 0x110]
call fcn.00456259
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x456393
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bb40
leave
ret 4
Function at 0x4575e0
Capabilities:
Resume thread

Disassembly:
sub esp, 8
mov ecx, dword [0x499318]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x14], eax
lea ebp, [eax + 1]
test ecx, ecx
je 0x45769e
mov dword [esp + 0x10], eax
jmp 0x457620
mov dword [0x4992fc], ebp
mov edx, dword [0x499318]
push 2
push edx
call esi
mov eax, dword [0x499318]
push eax
call edi
mov ecx, dword [0x499318]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x45765d
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x457620
cmp dword [esp + 0x10], 0x1e
jne 0x457679
push str.02100901:_Timeout_Error:_adxm_destroy_thrd__vsync_
call fcn.00461b70
add esp, 4
mov dword [esp + 0x14], 0xffffffff
xor eax, eax
mov dword [0x499300], eax
mov dword [0x4992fc], eax
mov edx, dword [0x499318]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x499314], eax
mov dword [0x499318], eax
mov ecx, dword [0x499320]
test ecx, ecx
je 0x45772a
mov dword [esp + 0x10], eax
mov dword [0x499304], ebp
mov edx, dword [0x499320]
push 2
push edx
call esi
mov eax, dword [0x499320]
push eax
call edi
mov ecx, dword [0x499320]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x4576ed
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x4576b0
cmp dword [esp + 0x10], 0x1e
jne 0x457705
push str.02100902:_Timeout_Error:_ADXWIN_DisableFsThrd
call fcn.00461b70
add esp, 4
sub dword [esp + 0x14], ebp
xor eax, eax
mov dword [0x499308], eax
mov dword [0x499304], eax
mov edx, dword [0x499320]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x49931c], eax
mov dword [0x499320], eax
mov ecx, dword [0x499328]
test ecx, ecx
je 0x4577bc
mov dword [esp + 0x10], eax
lea esp, [esp]
mov dword [0x49930c], ebp
mov edx, dword [0x499328]
push 2
push edx
call esi
mov eax, dword [0x499328]
push eax
call edi
mov ecx, dword [0x499328]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x45777d
mov eax, dword [esp + 0x10]
add eax, ebp
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x457740
cmp dword [esp + 0x10], 0x1e
jne 0x457795
push str.02100903:_Timeout_Error:_adxm_destroy_thrd__mwidle_
call fcn.00461b70
add esp, 4
sub dword [esp + 0x14], ebp
xor esi, esi
mov dword [0x499310], esi
mov dword [0x49930c], esi
mov edx, dword [0x499328]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x499324], esi
mov dword [0x499328], esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x457980
Capabilities:
Create thread

Disassembly:
push 0x499314
push 4
push 0
push 0x4578e0
push 0x100000
push 0
call fcn.0043fdb9
mov dword [0x499318], eax
mov eax, dword [0x499318]
add esp, 0x18
test eax, eax
jne 0x4579bc
push str.E02100911_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461b70
add esp, 4
or eax, 0xffffffff
ret
push 0x49931c
push 4
push 0
push 0x457940
push 0x100000
push 0
call fcn.0043fdb9
mov dword [0x499320], eax
mov ecx, dword [0x499320]
add esp, 0x18
test ecx, ecx
jne 0x4579f9
push str.E02100912_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461b70
add esp, 4
or eax, 0xffffffff
ret
push 0x499324
push 4
push 0
push 0x457530
push 0x100000
push 0
call fcn.0043fdb9
mov dword [0x499328], eax
mov edx, dword [0x499328]
add esp, 0x18
test edx, edx
jne 0x457a36
push str.E02100913_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00461b70
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x457a40
Capabilities:
Resume thread

Disassembly:
push esi
push 0x4992d4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x457b3e
push edi
xor edi, edi
mov dword [0x4992fc], edi
mov dword [0x499300], edi
mov dword [0x49930c], edi
mov dword [0x499310], edi
mov dword [0x4992e8], edi
call fcn.0045fda0
push edi
push edi
call fcn.0045fca0
push edi
push edi
call fcn.0045fcc0
push 0x457490
call fcn.0045fe40
add esp, 0x14
cmp esi, edi
jne 0x457abc
mov dword [0x4992d8], 2
mov dword [0x4992dc], 1
mov dword [0x4992e0], 0xfffffff1
jmp 0x457ad5
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [0x4992d8], eax
mov dword [0x4992dc], ecx
mov dword [0x4992e0], edx
call fcn.00457980
test eax, eax
jge 0x457aea
call fcn.004575e0
pop edi
pop esi
jmp fcn.0045fe00
call fcn.004577d0
test eax, eax
jge 0x457aff
call fcn.004575e0
pop edi
pop esi
jmp fcn.0045fe00
mov eax, dword [0x4992dc]
push eax
call fcn.004621b0
mov ecx, dword [0x499318]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
add esp, 4
push ecx
call esi
mov edx, dword [0x499320]
push edx
call esi
mov eax, dword [0x499328]
push eax
call esi
push edi
push 0x4574b0
push 6
call fcn.00460100
add esp, 0xc
pop edi
pop esi
ret
Function at 0x4587e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0046d4ce
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call esi
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
lea edx, [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x14]
push 0
push 0xf4240
push ecx
push eax
call fcn.00440200
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.00440240
push 0xa
mov edi, eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call esi
xor ebp, ebp
push ebp
push 0xa
push ebx
push edi
call fcn.00440240
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
call fcn.0046d4e0
lea eax, [esp + 0x18]
push eax
call esi
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, edi
sub ecx, dword [esp + 0x10]
push 0
mov edx, ebx
sbb edx, dword [esp + 0x18]
push 0xf4240
push edx
push ecx
call fcn.00440200
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.00440240
cmp edx, dword [esp + 0x2c]
jl 0x458918
jg 0x458903
cmp eax, dword [esp + 0x28]
jb 0x458918
inc ebp
cmp ebp, 0x80
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
jl 0x458893
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x466e30
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x14
xor eax, eax
push esi
test ecx, ecx
jle 0x466e5a
mov esi, dword [str.fmt]
mov esi, dword [esi]
lea ebx, [ebx]
cmp dword [eax + edx], esi
je 0x466e5a
inc eax
cmp eax, ecx
jl 0x466e50
cmp eax, ecx
jne 0x466e66
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
mov esi, dword [eax + edx + 0xc]
push ebx
mov ebx, dword [eax + edx + 0x10]
push edi
mov edi, dword [eax + edx + 8]
cmp di, 1
mov dword [esp + 0x14], ebx
mov ebx, dword [eax + edx + 0x14]
mov eax, dword [eax + edx + 0x18]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
jg 0x466eae
xor eax, eax
test ecx, ecx
jle 0x466eaa
mov edi, dword [str.data]
mov edi, dword [edi]
cmp dword [eax + edx], edi
je 0x466eaa
inc eax
cmp eax, ecx
jl 0x466ea0
cmp eax, ecx
jne 0x466eb8
pop edi
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
movzx ecx, byte [eax + edx + 7]
movzx edi, byte [eax + edx + 6]
shl ecx, 8
or ecx, edi
movzx edi, byte [eax + edx + 5]
movzx edx, byte [eax + edx + 4]
shl ecx, 8
or ecx, edi
mov edi, dword [esp + 0x3c]
add eax, 8
shl ecx, 8
or ecx, edx
mov edx, dword [esp + 0x2c]
mov word [edx], ax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
mov byte [eax], 0xff
movzx eax, byte [esp + 0xe]
mov dword [edx], esi
mov esi, dword [esp + 0x34]
mov dl, byte [esp + 0x1a]
mov byte [edi], al
mov byte [esi], dl
push ebp
mov ebp, dword [esp + 0x3c]
mov byte [ebp], bl
movsx ebx, bl
mov eax, ecx
cdq
idiv ebx
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [ebx], eax
mov dword [edx], 1
mov al, byte [esi]
cmp al, 0x10
jne 0x466f38
mov ecx, dword [esp + 0x50]
xor eax, eax
mov word [ecx], ax
jmp 0x466f72
cmp al, 8
jne 0x466f43
mov edx, 1
jmp 0x466f6b
cmp al, 4
jne 0x466f72
mov al, byte [edi]
add al, al
mov byte [ebp], al
mov dword [edx], 4
mov eax, ecx
movsx ecx, byte [edi]
cdq
sub eax, edx
sar eax, 1
cdq
idiv ecx
mov edx, 2
mov dword [ebx], eax
mov byte [esi], 0x10
mov eax, dword [esp + 0x50]
mov word [eax], dx
cmp byte [esi], 0
je 0x466f9c
cmp byte [ebp], 0
je 0x466f9c
mov al, byte [edi]
test al, al
jle 0x466f9c
cmp al, 2
jg 0x466f9c
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx]
neg eax
pop ebp
sbb eax, eax
pop edi
neg eax
pop ebx
dec eax
pop esi
add esp, 0x14
ret
pop ebp
pop edi
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x467850
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
test eax, eax
je 0x467895
mov edi, dword [esp + 0xc]
test edi, edi
je 0x467895
push esi
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x467884
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x467884
pop esi
xor eax, eax
pop edi
ret
mov edx, dword [esp + 0xc]
mov dword [edi], esi
pop esi
mov dword [edi + 4], edx
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x467ec0
Capabilities:
Create thread

Disassembly:
push ecx
test eax, eax
jne 0x467ed6
push str.NULL_pointer_is_passed.
call fcn.00461b70
add esp, 4
xor eax, eax
pop ecx
ret
cmp dword [esp + 8], 0x50
jae 0x467eee
push str.Work_area_size_is_too_short.
call fcn.00461b70
add esp, 4
xor eax, eax
pop ecx
ret
push esi
lea esi, [eax + 3]
push 0x4c
and esi, 0xfffffffc
push 0
push esi
call fcn.0043ec20
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x467f29
push str.E2004112601_:_Can_not_create_wait_event.
call fcn.00461b70
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esi + 0x14]
push 0x1c
push eax
call fcn.00465230
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
jne 0x467f5a
push str.E2004112602_:_Can_not_create_critical_section.
call fcn.00461b70
mov ecx, dword [esi + 0xc]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x467e30
push 0
push 0
call fcn.0043fdb9
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
jne 0x467fa2
push str.E2004112603_:_Can_not_create_thread.
call fcn.00461b70
mov eax, dword [esi + 0xc]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x10]
push ecx
call fcn.00465330
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
cmp dword [esi + 0x3c], 0
jne 0x467fbb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0xa
call edi
cmp dword [esi + 0x3c], 0
je 0x467fb0
pop edi
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0xffffffff
mov dword [esi], 1
mov eax, esi
pop esi
pop ecx
ret

Function at 0x469ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov al, byte [esi + ecx + 1]
push edi
xor edi, edi
mov dword [esp + 8], edi
mov byte [esp + 5], al
test al, 6
je 0x46a00d
xor eax, eax
pop edi
add esp, 8
ret
mov dl, byte [esi + ecx + 2]
mov byte [esp + 7], dl
and dl, 0xc0
cmp dl, 0x40
jne 0x46a006
push ebx
push ebp
mov ebp, dword [esp + 0x18]
add ebp, 0xfffffff8
cmp ecx, ebp
jge 0x46a0b3
movzx edx, byte [esi + ecx]
mov byte [esp + 0xe], dl
mov dl, byte [esi + ecx + 3]
jmp 0x46a044
mov al, byte [esp + 0xd]
mov bl, byte [esp + 0xe]
cmp bl, byte [ecx + esi]
jne 0x46a052
mov edi, 1
cmp al, byte [esi + ecx + 1]
jne 0x46a059
inc edi
mov al, byte [esp + 0xf]
cmp al, byte [esi + ecx + 2]
jne 0x46a064
inc edi
mov al, byte [esi + ecx + 3]
cmp dl, al
je 0x46a075
mov bl, dl
xor bl, al
test bl, 0xf0
jne 0x46a076
inc edi
cmp edi, 4
jl 0x46a0b3
mov edi, dword [esp + 0x10]
inc edi
cmp edi, 3
mov dword [esp + 0x10], edi
jge 0x46a0bc
movzx edi, byte [ecx + esi + 4]
movzx eax, al
and eax, 3
shl eax, 8
or eax, edi
movzx edi, byte [ecx + esi + 5]
add eax, eax
add eax, eax
add eax, eax
shr edi, 5
or eax, edi
jle 0x46a0b3
add ecx, eax
xor edi, edi
cmp ecx, ebp
jl 0x46a040
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 8
ret
Function at 0x46a8a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push edi
mov ebp, 0xfffffff4
test ecx, ecx
je 0x46aa55
mov edi, dword [esp + 0x20]
test edi, edi
jle 0x46aa55
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x46aa55
lea eax, [edi - 0xc]
cmp eax, ebp
push esi
jle 0x46aa40
jmp 0x46a8e4
mov edi, dword [esp + 0x24]
lea eax, [ebp + 0xc]
mov edx, edi
call fcn.0046a770
mov ebp, eax
test ebp, ebp
jl 0x46aa4a
lea eax, [ebp + 0xc]
push edi
call fcn.0046a7c0
push edi
mov esi, eax
call fcn.0046a830
mov edi, eax
add esp, 8
test edi, edi
jge 0x46a91d
mov eax, dword [esp + 0x24]
add eax, 0xfffffff4
cmp ebp, eax
jl 0x46a8e0
mov dword [ebx], 5
lea eax, [esi + ecx + 0xb]
mov dword [esp + 0x20], eax
movzx eax, byte [eax]
shl eax, 8
lea edx, [esi + ecx + 0xa]
mov dword [esp + 0x10], edx
movzx edx, byte [edx]
or eax, edx
mov dword [ebx + 8], eax
movzx eax, byte [esi + ecx + 0xf]
movzx edx, byte [esi + ecx + 0xe]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0xd]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0xc]
shl eax, 8
or eax, edx
mov dword [ebx + 4], eax
movzx eax, byte [esi + ecx + 0x13]
movzx edx, byte [esi + ecx + 0x12]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0x11]
shl eax, 8
or eax, edx
movzx edx, byte [esi + ecx + 0x10]
shl eax, 8
or eax, edx
add eax, eax
add eax, eax
add eax, eax
mov dword [ebx + 0x28], eax
movzx eax, byte [esi + ecx + 0x17]
lea edx, [esi + ecx + 0x17]
shl eax, 8
lea esi, [esi + ecx + 0x16]
mov dword [esp + 0x14], esi
movzx esi, byte [esi]
or eax, esi
mov esi, dword [esp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x20]
movzx eax, byte [eax]
movzx esi, byte [esi]
shl eax, 8
or eax, esi
mov esi, dword [esp + 0x14]
movzx esi, byte [esi]
mov dword [esp + 0x18], edx
movzx edx, byte [edx]
shl edx, 8
or edx, esi
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x2c], eax
movzx eax, byte [edi + ecx + 7]
movzx edx, byte [edi + ecx + 6]
shl eax, 8
or eax, edx
movzx edx, byte [edi + ecx + 5]
movzx ecx, byte [edi + ecx + 4]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x20]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx]
mov edx, dword [esp + 0x10]
movzx edx, byte [edx]
shl ecx, 8
or ecx, edx
cdq
idiv ecx
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx]
mov edx, dword [esp + 0x14]
movzx edx, byte [edx]
shl ecx, 8
or ecx, edx
cdq
idiv ecx
add eax, eax
add eax, eax
add eax, eax
cdq
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
Function at 0x46ac00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x20]
movsx eax, word [ecx + 2]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x20], eax
xor eax, eax
push edi
movsx edi, word [ecx]
mov dword [esp + 0x1c], eax
test esi, esi
jle 0x46ad82
mov ebx, dword [esp + 0x2c]
jmp 0x46ac36
mov edx, dword [esp + 0x10]
movzx ecx, word [edx]
mov ebp, dword [esp + 0x3c]
mov esi, ecx
sar esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
movzx esi, si
test esi, 0x8000
jne 0x46ad90
movzx ecx, word [ebp]
mov eax, ecx
imul ecx, dword [esp + 0x40]
add ecx, dword [esp + 0x44]
xor eax, esi
and eax, 0x1fff
inc eax
movzx esi, ax
movsx eax, word [esp + 0x34]
and ecx, 0x7fff
mov word [ebp], cx
movsx ebp, word [esp + 0x38]
movsx ecx, si
add edx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0x10
jmp 0x46aca4
mov edx, dword [esp + 0x10]
movsx esi, byte [edx]
inc edx
mov dword [esp + 0x10], edx
mov edx, eax
imul edx, edi
mov eax, ebp
imul eax, dword [esp + 0x24]
mov ecx, esi
sar ecx, 4
imul ecx, dword [esp + 0x14]
add edx, eax
sar edx, 0xc
add edx, ecx
cmp edx, 0x7fff
jg 0x46ace0
cmp edx, 0xffff8000
jge 0x46acf4
mov edx, 0xffff8000
jmp 0x46acf4
cmp edx, 0xffff8000
jge 0x46acef
mov edx, 0xffff8000
jmp 0x46acf4
mov edx, 0x7fff
movsx eax, word [esp + 0x34]
mov word [ebx], dx
mov dword [esp + 0x24], edx
mov ecx, eax
imul ecx, edx
mov edx, ebp
imul edx, edi
add ecx, edx
and esi, 0xf
mov edx, dword [esi*4 + 0x47ea68]
imul edx, dword [esp + 0x14]
sar ecx, 0xc
add ecx, edx
add ebx, 2
cmp ecx, 0x7fff
jg 0x46ad3a
cmp ecx, 0xffff8000
jge 0x46ad4e
mov ecx, 0xffff8000
jmp 0x46ad4e
cmp ecx, 0xffff8000
jge 0x46ad49
mov ecx, 0xffff8000
jmp 0x46ad4e
mov ecx, 0x7fff
mov edx, dword [esp + 0x24]
mov word [ebx], cx
add ebx, 2
sub dword [esp + 0x18], 1
mov dword [esp + 0x24], edx
mov edi, ecx
jne 0x46aca0
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
inc eax
cmp eax, esi
mov dword [esp + 0x1c], eax
jl 0x46ac32
mov ecx, dword [esp + 0x30]
mov ax, word [esp + 0x24]
mov word [ecx + 2], ax
mov word [ecx], di
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x401db3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401df2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401df2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401df2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401df2
cmp dword [ecx + 0x74], 0xe
jbe 0x401df2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret