joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72937460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x729570b2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x3c], 1
mov edi, edi
cmp dword [esp + 0x7c], 0x10
mov eax, dword [esp + 0x68]
jae 0x729374af
lea eax, [esp + 0x68]
mov ecx, dword [esp + 0x78]
push ecx
push eax
lea edx, [esp + 0x4c]
push edx
call fcn.72878510
mov esi, eax
cmp esi, 0xffffffff
je 0x72937532
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x3c], 2
push esi
push ebx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.72871670
inc esi
push esi
push ebx
lea ecx, [esp + 0x4c]
call fcn.728718b0
lea ecx, [esp + 0x14]
push ecx
mov ebx, ebp
call fcn.728721d0
mov byte [esp + 0x3c], 1
cmp dword [esp + 0x2c], 0x10
jb 0x7293751f
mov edx, dword [esp + 0x18]
push edx
call fcn.728ad346
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
jmp 0x729374a0
lea edi, [esp + 0x44]
mov ecx, 0x729910bb
call fcn.72878360
test al, al
jne 0x7293754e
mov eax, edi
push eax
mov ebx, ebp
call fcn.728721d0
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov esi, 0x10
cmp dword [esp + 0x5c], esi
jb 0x7293756c
mov ecx, dword [esp + 0x48]
push ecx
call fcn.728ad346
add esp, 4
mov edi, 0xf
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x7c], esi
jb 0x72937598
mov edx, dword [esp + 0x68]
push edx
call fcn.728ad346
add esp, 4
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.728ad351
add esp, 0x2c
ret 0x3c
Function at 0x72939260
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
mov eax, edx
push edi
lea esi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x72939284
sub eax, esi
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.729390a0
add esp, 4
lea esi, [esp + 0x10]
lea ecx, [esp + 0x6c]
call fcn.72939180
xor esi, esi
lea edi, [esp + 0x7d]
mov bl, byte [esp + esi + 0x6c]
movzx eax, bl
push eax
push 0x72995814
lea ecx, [edi - 1]
push 0x27
push ecx
call fcn.728add62
shl bl, 4
movzx edx, bl
push edx
push 0x7299581c
push 0x27
push edi
call fcn.728add62
inc esi
add esp, 0x20
add edi, 2
cmp esi, 0x10
jl 0x729392d5
push 0x20
lea eax, [esp + 0x80]
push eax
push 0x729b5ae0
call fcn.728b12c0
mov ecx, dword [esp + 0xb0]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x729b5ae0
call fcn.728ad351
mov esp, ebp
pop ebp
ret

Function at 0x7293d290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72957148
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push 0x729b2170
push eax
mov ecx, 0x72996b9c
call fcn.728730b0
xor ebx, ebx
mov dword [esp + 0x3c], ebx
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x30]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.72871670
mov byte [esp + 0x50], 1
mov byte [esp + 0x50], bl
call fcn.7293be30
add esp, 0x1c
push eax
call fcn.72af8337
scasd eax, dword es:[edi]
test eax, eax
jne 0x7293d354
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x34]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.72871670
mov byte [esp + 0x54], 2
mov byte [esp + 0x54], bl
call fcn.7293be30
add esp, 0x1c
push eax
push ebx
call fcn.72b14ca1
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x7293d370
mov ecx, dword [esp + 0x10]
push ecx
call fcn.728ad346
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.728ad351
add esp, 0x30
ret
Function at 0x72952850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72956f7d
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], 1
lea eax, [esp + 0x1c]
push eax
lea ebx, [esi + 0x30]
call fcn.728721d0
lea ecx, [esp + 0x38]
push ecx
lea ebx, [esi + 0x48]
call fcn.728721d0
xor ebx, ebx
mov byte [esp + 0x14], bl
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x729528b4
mov edx, dword [esp + 0x20]
push edx
call fcn.728ad346
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x14], 0xffffffff
cmp dword [esp + 0x50], esi
jb 0x729528df
mov eax, dword [esp + 0x3c]
push eax
call fcn.728ad346
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x38

Function at 0x72952910
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x72956fa8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
call fcn.728721d0
lea ecx, [esp + 0x34]
push ecx
add ebx, 0x18
call fcn.728721d0
xor ebx, ebx
mov byte [esp + 0x10], bl
cmp dword [esp + 0x30], 0x10
jb 0x7295296c
mov edx, dword [esp + 0x1c]
push edx
call fcn.728ad346
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x10], 0xffffffff
cmp dword [esp + 0x4c], 0x10
jb 0x72952998
mov eax, dword [esp + 0x38]
push eax
call fcn.728ad346
add esp, 4
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0xc
ret 0x38

Function at 0x72952cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7295707f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.72872080
mov dword [esp + 0x14], 0
lea eax, [esi + 0x18]
push eax
call fcn.72872080
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x30]
push ecx
call fcn.72872080
mov byte [esp + 0x14], 2
lea edx, [esi + 0x48]
push edx
call fcn.72872080
mov byte [esp + 0x14], 3
lea eax, [esi + 0x60]
push eax
call fcn.72872080
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x78]
push ecx
call fcn.72872080
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x72953045
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebp
mov word [esp], 0x29dd
call fcn.7294b26d
pushfd
lea esp, [esp + 0x20]
je 0x729536e1
jmp 0x72953999
lea esp, [esp + 0x1c]
jne 0x72953050
test bh, al
pushfd
push dword [esp]
xor eax, eax
jmp 0x7293e301
stc
stc
xor eax, eax
clc
stc
xchg dword [ebp + ecx*4], eax
pushal
bt edi, 0x13
mov dword [esp + 0x1c], eax
cmc
sub ecx, 1
mov byte [esp], 0xec
jmp 0x729536d7

Function at 0x72953764
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rcl eax, cl
inc ah
lea eax, [edi + 0x50]
call fcn.7294b2a1
call fcn.72953045
Function at 0x72956290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72957816
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push ebx
push ebp
mov eax, dword [0x7299f330]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc4], ebx
mov ebp, dword [esp + 0xcc]
mov dword [esp + 0xc], ebx
mov edx, 0x150
mov ecx, 0x8d
mov eax, 0x15c
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov edx, 0x12f
mov ecx, 0x123
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x80], esi
mov dword [esp + 0x10], 0x138
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x159
mov dword [esp + 0x24], 0xae
mov dword [esp + 0x34], 0x144
mov dword [esp + 0x38], 0x15f
mov dword [esp + 0x3c], 0x135
mov dword [esp + 0x40], 0x13b
mov dword [esp + 0x44], 0x14a
mov dword [esp + 0x48], 0x8a
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], 0x16b
mov dword [esp + 0x54], 0x12c
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], 0x8a
mov dword [esp + 0x68], 0x14a
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], eax
mov byte [esi + 4], bl
mov dword [esp + 0xc4], ebx
mov eax, dword [0x729b587c]
mov dword [esp + 0xc], 1
cmp eax, ebx
jne 0x72956454
cmp dword [0x729b1fe0], ebx
jbe 0x72956454
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xd0]
push eax
push ecx
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0xa0], esp
push edx
call fcn.72872f00
add esp, 4
mov dword [esp + 0xe8], 1
push edi
mov byte [esp + 0xec], bl
mov edx, ebp
lea ecx, [esp + 0xc8]
call fcn.729547c0
mov dword [esp + 0xc4], 2
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.72871670
mov byte [esp + 0xc4], bl
cmp dword [esp + 0xb8], 0x10
jb 0x72956439
mov eax, dword [esp + 0xa4]
push eax
call fcn.728ad346
add esp, 4
mov dword [esp + 0xb8], 0xf
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
jmp 0x729564c8
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0xd0]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
push edi
mov edx, ebp
lea ecx, [esp + 0x94]
call fcn.72955530
mov dword [esp + 0xc4], 3
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.72871670
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x9c], 0x10
jb 0x729564af
mov ecx, dword [esp + 0x88]
push ecx
call fcn.728ad346
add esp, 4
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
mov eax, dword [0x729b587c]
inc eax
cmp eax, 3
jg 0x729564e3
mov dword [0x729b587c], eax
cmp dword [esi + 0x14], ebx
je 0x729563a8
jmp 0x729564e9
mov dword [0x729b587c], ebx
mov eax, esi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xbc
ret 0xc
Function at 0x729e744b
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xdd7f2274
cmp bh, 0x43
bt cx, bx
xor edx, 0x2fe2972
test ebx, ebx
xor ebp, 0x9fb38840
mov byte [esp], 0x9a
and al, 0x9a
push esi
xor edi, 0x437ffa5e
test bl, 0xc1
pushfd
xor ebx, 0xffee1b3f
call fcn.72a1997c
test ch, dl
js 0x729e7467
and eax, 0xb399e614
and al, 0xad
dec esi
sbb edx, dword [edx - 0x2ed54daa]
mov dl, 0x73
mov eax, 0x712bba39
sbb esi, eax
out 0x3d, eax
mov ebx, 0x149ddff1
invalid

Function at 0x72ac2166
Capabilities:
Execute syscall

Disassembly:
jmp 0x72ad6f69
lea eax, [eax - 0x2f62eac6]
call fcn.729ed4dc
sub ah, byte [edx + 0x52a5e18]
out 0xc9, al
add eax, 0x55544b6a
push 0xfffffffffffffffb
jo 0x72ad6fe7
add dword [ebp + esi*4 + 0x1dd891ec], ecx
scasb al, byte es:[edi]
lodsd eax, dword [si]
fistp dword [edx + edx*4 - 0x7359b2c0]
push esi
lodsd eax, dword [esi]
push esp
out dx, eax
mov cl, 0xc2
xlatb
push 0x7460c932
syscall
shr byte [esi + 0x49], 0x4b
ret
push es
outsd dx, dword es:[esi]
imul byte [eax + 0x1fb66469]
or al, 0xaf
inc eax
aad 0x8c
rcl byte [ebx], 0x5f
mov byte [0x625d5cd5], al
div dword [0xd0e9ee87]
jecxz 0x72ad705f
xor byte [ebp - 0x4d], cl
scasd eax, dword es:[edi]
sbb al, 1
cld
push cs
lcall 0xd730, 0x35da296f
dec ebp
aaa
pushal
jnp 0x72ad7029
xor al, dh
fst st(1)
mov bh, byte [ebx + 0x66]
mov edx, 0xfb31f925
adc ebp, eax
cmp esi, dword [esi]
outsd dx, dword [esi]
outsd dx, dword ss:[esi]
cmc
mov ebx, 0x74916a29
out 0x46, eax
call 0x482482a4
or al, 0x1d
pop ds
mov al, 0xd7
or esp, dword [ebp - 0x23ca56c5]
and byte [ebx - 0x59], dh
add eax, 0x9c2a26a3
sti
mov dl, 0xf1
xor esp, ecx
mov esi, 0x8cb55c88
das
sub eax, 0x50e6052a
invalid
daa
popal
bound ebp, qword [edi + 0x40]
dec ecx
retf 0x8f06
Function at 0x72b0f236
Capabilities:
Encode data using xor

Disassembly:
call fcn.729e4865
add bl, 0xf8
push ss
add al, ch
dec ecx
mov dword [0x89660005], eax
sub al, 0x24
push esp
lea esi, [esi + 1]
pushfd
jmp 0x72a0ec91
lea ebp, [ebp - 0x76c42753]
mov word [esp + 8], 0xade0
call fcn.72aec238
xchg dx, ax
dec eax
push edi
adc al, 0xe6
jbe 0x729e4375
add dword [eax], esi
pop eax
loope 0x729e43e7
aas
xor ecx, dword [eax - 0x42]
mov ebx, 0xc6ce27e0
mov bh, 0x60
pop ecx
and ebp, esp
jge 0x729e432f
daa
into
invalid
movsb byte es:[edi], byte [esi]
sti
inc esi
movsb byte es:[edi], byte [esi]
invalid
push 0x648eef34
sal ecx, 0xf5
jno 0x729e4432
pushal
loope 0x729e43fb
xor ch, dh
inc esi
cmp eax, 0xe614569d
mov ah, byte [0x97f0bc6]
jg 0x729e4406
fcmovbe st(0), st(0)
clc
push ebp
jbe 0x729e43e2
mov dh, 0xcf
cmpsb byte [esi], byte es:[edi]
cmp edi, dword [ebp + eax + 0x16]
out 0xe8, eax
leave
or bl, bl
mov word [edx + 0x7d67ee4a], fs
sbb eax, 0x98464567
in eax, 0x31
pop ebp
std
sub dword [ecx + 0x3f], ebp
cwde
push ds
nop
xor al, 0xab
invalid
mov esp, 0xfbeefca3
jae 0x729e4479
and dh, byte [esi - 0x2c]
pop ebx
insd dword es:[edi], dx
inc ebx
vmovdqu ymmword [edi], ymm2
test eax, 0x87987a0
pop es
sbb byte [ecx - 0x624537d8], al
aaa
xor ebp, esp
mov edx, 0xe531379d
sbb eax, 0xbb5870c
xor al, 0xa8
test al, 0xba
js 0x729e44cc
mov dh, 0xe7
mov eax, 0x3ce0d853
movsd dword es:[edi], dword [esi]
and eax, 0xb765eb43
dec ecx
mov bh, 0x49
cmpsd dword [esi], dword es:[edi]
jle 0x729e445b
popal
invalid
mul edi
aas
or ch, byte ds:[ecx]
sar cl, 1
fnsave dword [ebp + 0x644de4d2]
fidivr dword [edi + 0x2c]
outsb dx, byte [esi]
pop eax
loope 0x729e4469
into
inc ebx
jno 0x729e444d
inc esi
stosb byte es:[edi], al
test al, 0xf
adc bl, bl
in al, dx
cmp byte [esi - 0x4332039f], 0xe7
pop ebp
hlt
xor ebp, dword [edx - 0x62]
mov dh, 0xfe
fist word [esi + ebp*4 - 0x40]
sub al, 0x56
ror byte [esi + ebp*8 + 0x1231baa8], cl
test al, 0xba
xor dword [edx], edx
mov dl, 0xa4
cdq
sar byte [0x263b40c0], 0x33
dec ebp
pop esi
sar dword [0xe17aea26], cl
fst dword [ebp + 0x16802431]
dec esp
sub eax, 0x525bb03c
fstp dword [ebp*4 + 0x697f9116]
loope 0x729e44be
add cl, al
push 0xcc7c413d
xchg ebp, eax
test dword [edx], edi
pop edx
sal dword [esi], 1
cmp dword [edx], 0x70977f1
push ebx
pop es
cdq
xor byte [edx], bh
adc bl, bh
bnd jns 0x729e4590
ja 0x729e4528
adc esp, dword [0x53fda49b]
dec eax
invalid
lds eax, [eax]
invalid
xlatb
mov edi, 0x90a4de2d
jnp 0x729e45ae
xchg edi, ebx
imul esp, dword [eax + 7], 0x16ca6293
adc dl, bl
sub dword [ebp - 0x25], 0x1607935c
lcall 0x84b7, 0xddbe7d7b
inc esp
mov esi, 0x4484b7dd
add bl, byte [esi*4 - 0x3698b865]
aaa
sub al, 0xee
test al, 0x3e
invalid
mov dword [esp + 0x10], esi
movzx si, cl
mov esi, 0x728c1ba4
mov byte [esp], 0x50
jmp 0x729bba9c
mov ebp, dword [ebp + 0x23b5ac]
jmp 0x729e434f
Function at 0x72b1652c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x72b21b82
lea esp, [esp + 0x2c]
je 0x72bc1adc
bt di, 7
btr dx, 9
mov esi, dword [eax + 0x3c]
dec dl
btr edx, ebx
pushfd
dec dh
add esi, eax
bts dx, si
not dl
lea edx, [eax - 0x4865d343]
mov edx, dword [esi + 0x78]
pushal
test bh, 0x7e
test edx, edx
pushal
pushfd
push dword [esp]
jmp 0x72b24dc8
lea esp, [esp + 0x4c]
je 0x72bc1adc
shr ecx, 0x10
clc
test dx, si
add edx, eax
dec ecx
mov ecx, dword [esi + 0x7c]
pushfd
add ecx, edx
clc
jmp 0x72bbe21c
dec ebp
cld
bt bp, si
push 0xaf5b6fcf
call fcn.72b24576
popfd
in al, 0x6b
outsd dx, dword [esi]
dec edx
add dh, ah
mov eax, 0x8261f453
not byte [ecx + 0x5e]
scasd eax, dword es:[edi]
fcomp dword [edi + 0x74]
cmc
push 0xffffffffffffffcb
je 0x72b24ef9
das
in al, 0xa4
mov ch, 0x12
jmp 0x8240547c
clc
mov dword [ebp - 0x10], ecx
bt di, di
rol ch, 6
adc cx, dx
mov ecx, dword [ebp + 0xc]
stc
bt dx, 0xa
test bh, 0x12
cmp ecx, 0xffff
pushal
mov byte [esp + 0x10], 0xd9
lea esp, [esp + 0x24]
jbe 0x72b24f2e
shr di, cl
not di
clc
btr ecx, 1
mov edi, dword [edx + 0x24]
ror cl, cl
rol cx, cl
rcl bl, 1
add edi, eax
xchg ch, bh
rol ch, cl
shl bh, cl
mov ebx, dword [edx + 0x20]
test ah, cl
btc ecx, ebx
add ebx, eax
movsx cx, al
pushal
bt edi, 5
mov dword [ebp - 8], 0
push 0x6e3f144
sar cx, 5
cmc
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x24]

Function at 0x72d34c36
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
lea esp, [esp + 0x20]
je 0x72d35a92
jmp 0x72d35c1f
add dword [ebp + 4], eax
mov byte [esp], 6
push 0xbd7f779e
pushfd
pushfd
pop dword [esp + 8]
jmp 0x72d35119
push dword [esp + 8]
pop dword [ebp]
mov dword [esp + 8], 0xd236c6ad
lea esp, [esp + 0xc]
jmp 0x72d350d1
lea esp, [esp + 0x1c]
jne 0x72d34c41
test bh, al
pushfd
push dword [esp]
xor eax, eax
jmp 0x72d35ad1
mov dword [esp], ebp
mov word [esp], 0x29dd
call fcn.72d36117
jmp 0x72d34e1f
stc
stc
xor eax, eax
clc
stc
xchg dword [ebp + ecx*4], eax
pushal
bt edi, 0x13
mov dword [esp + 0x1c], eax
cmc
sub ecx, 1
mov byte [esp], 0xec
jmp 0x72d35a88
Function at 0x402860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
jmp 0x4028a3
inc dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0x38c8ca4
jmp 0x4028f0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + 1]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x14]
movzx ecx, word [edx + ecx*2]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
or ecx, edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
sete byte [ebp - 9]
mov dword [ebp - 0x2c], 0xd8b1578d
nop
nop
nop
mov eax, dword [ebp - 0x2c]
cmp eax, 0x67d319d5
jg 0x402920
cmp eax, 0x5db750f7
jg 0x402930
cmp eax, 0x39f1f280
jg 0x40293c
cmp eax, 0xd8b1578c
jg 0x402953
cmp eax, 0xcf048599
jne 0x4028f0
jmp 0x402a20
cmp eax, 0x67d319d6
jne 0x4028f0
jmp 0x4028ac
cmp eax, 0x5db750f8
jne 0x4028f0
jmp 0x4028a0
cmp eax, 0x39f1f281
jne 0x4028f0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x46d92f2
jmp 0x4028f0
cmp eax, 0x38c8ca3
jg 0x40297a
cmp eax, 0xd8b1578d
jne 0x4028f0
mov al, byte [ebp - 9]
test al, al
mov eax, 0x39f1f281
jne 0x402972
mov eax, 0x46d92f2
mov dword [ebp - 0x2c], eax
jmp 0x4028f0
cmp eax, 0x46d92f1
jg 0x4029a6
cmp eax, 0x38c8ca4
jne 0x4028f0
mov ecx, dword [ebp - 0x24]
mov eax, 0x10a304ed
cmp ecx, dword [ebp - 0x1c]
jb 0x40299e
mov eax, 0xcf048599
mov dword [ebp - 0x2c], eax
jmp 0x4028f0
cmp eax, 0x46d92f2
je 0x402a14
cmp eax, 0x10a304ed
je 0x402a08
cmp eax, 0x10e0d39c
jne 0x4028f0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + 1]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x14]
movzx ecx, word [edx + ecx*2]
mov edx, eax
not edx
and edx, 0xf112
and eax, 0xeed
mov esi, ecx
not esi
and esi, 0xf112
and ecx, 0xeed
add eax, edx
add ecx, esi
xor ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov word [edx + eax*2], cx
mov dword [ebp - 0x2c], 0x67d319d6
jmp 0x4028f0
mov dword [ebp - 0x2c], 0x5db750f8
jmp 0x4028f0
add esp, 0x24
pop esi
pop edi
pop ebp
ret
Function at 0x4039e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x95aa1567
jmp 0x403a2e
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x2ebe88d4
mov eax, dword [ebp - 0x14]
cmp eax, 0x6cc58629
jg 0x403a50
cmp eax, 0x95aa1567
je 0x403a70
cmp eax, 0xb8101795
je 0x403a20
cmp eax, 0x2ebe88d4
jne 0x403a2e
jmp 0x403a85
cmp eax, 0x6cc5862a
jne 0x403a2e
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x2ebe88d4
jmp 0x403a2e
mov eax, 0x6cc5862a
cmp dword [ebp - 4], 0
je 0x403a80
mov eax, 0xb8101795
mov dword [ebp - 0x14], eax
jmp 0x403a2e
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret

Function at 0x403a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x945ecbd1
jmp 0x403ade
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0xdb32d64e
mov eax, dword [ebp - 0x14]
cmp eax, 0xf922c514
jg 0x403b10
cmp eax, 0x8b449949
je 0x403ad0
cmp eax, 0x945ecbd1
jne 0x403b27
mov eax, 0x8b449949
cmp dword [ebp - 4], 0
je 0x403b06
mov eax, 0xf922c515
mov dword [ebp - 0x14], eax
jmp 0x403ade
cmp eax, 0xf922c515
jne 0x403ade
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0xdb32d64e
jmp 0x403ade
cmp eax, 0xdb32d64e
jne 0x403ade
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret
Function at 0x40b440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x40b130
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00416fd3
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x4e6dd9df
jmp 0x40b4b0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0xbc11a0c8
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0xe4994e2a
jg 0x40b4d0
cmp eax, 0xbc11a0c8
jne 0x40b4b0
jmp 0x40b56f
cmp eax, 0x179db32
jg 0x40b500
cmp eax, 0xe4994e2b
jne 0x40b4b0
mov eax, 0x45492163
cmp dword [ebp - 0xc], 0
jne 0x40b4ee
mov eax, 0xbc11a0c8
mov dword [ebp - 0x10], eax
jmp 0x40b4b0
cmp eax, 0xe8493b8
jg 0x40b52e
cmp eax, 0x179db33
jne 0x40b4b0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0xe4994e2b
jmp 0x40b4b0
cmp eax, 0xe8493b9
je 0x40b563
cmp eax, 0x45492163
je 0x40b494
cmp eax, 0x4e6dd9df
jne 0x40b4b0
mov eax, 0xe8493b9
cmp dword [ebp - 4], 0
je 0x40b55b
mov eax, 0x179db33
mov dword [ebp - 0x10], eax
jmp 0x40b4b0
mov dword [ebp - 0x10], 0xe4994e2b
jmp 0x40b4b0
add esp, 0x28
pop ebp
ret