joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c4dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x48c502
push 0
mov eax, dword [ebx + 0x94]
call fcn.0045c560
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x48c5bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c72d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x48c712
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409528
mov dl, 1
mov eax, dword [0x462174]
call fcn.004621cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x4170f0]
call fcn.00403354
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00462248
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x48c70f
mov dl, 1
mov eax, dword [0x463774]
call fcn.004637dc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, 0x48c744
call fcn.004629b0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040450c
xor eax, eax
push ebp
push 0x48c708
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00463adc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0048c74c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c70f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00403384
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403384
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403384
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c734
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404224
ret
Function at 0x4a2aa8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415cf8]
call fcn.00404cd0
xor eax, eax
push ebp
push 0x4a2bec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4efc5c], 0
jne 0x4a2afb
mov ecx, dword [0x4f100c]
mov dl, 1
mov eax, dword [0x40794c]
call fcn.0040c570
call fcn.00403b10
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d70
mov eax, ebx
call fcn.00404a88
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a2bfc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405d78
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a98
test eax, eax
jle 0x4a2b93
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a2b8c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404488
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404470
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408794
test eax, eax
jne 0x4a2b8c
mov ebx, 0x15
jmp 0x4a2b98
mov ebx, 0x10
jmp 0x4a2b98
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4efc5c]
call fcn.004a2a00
mov eax, dword [ebp - 8]
call fcn.004a2a00
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2bf3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404224
lea eax, [ebp - 0x10]
mov edx, dword [0x415cf8]
call fcn.00404da0
ret
Function at 0x4b2628
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b2630
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b2822
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b2838
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404254
lea ecx, [ebp - 0x10]
mov edx, 0x4b284c
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404254
lea ecx, [ebp - 0x14]
mov edx, 0x4b2864
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404254
lea ecx, [ebp - 0x18]
mov edx, 0x4b2880
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404254
lea ecx, [ebp - 0x1c]
mov edx, 0x4b289c
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404254
lea ecx, [ebp - 0x24]
mov edx, 0x4b28b4
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408804
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408d7c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b28cc
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x28]
call fcn.004af4d0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b28dc
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x2c]
call fcn.004af4d0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b28f4
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408d7c
inc eax
je 0x4b27c5
lea ecx, [ebp - 0x34]
mov edx, 0x4b28f4
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x34]
call fcn.00408d40
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a324
fstp qword [ebp - 0x3c]
wait
call fcn.0040a688
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b27e0
lea ecx, [ebp - 0x40]
mov edx, 0x4b28f4
mov eax, esi
call fcn.004b03b8
mov eax, dword [ebp - 0x40]
call fcn.004af4d0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b2904
mov eax, esi
call fcn.004b03b8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2829
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404224
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404224
ret
Function at 0x4beac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4beb1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004beab0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ae13c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004add3c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4beb21
lea eax, [ebp - 4]
call fcn.00404200
ret

Function at 0x4c1f84
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
or esi, 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
xor ecx, ecx
push ebp
push 0x4c1fde
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp + 0x14]
dec edx
test edx, edx
jb 0x4c1fd4
inc edx
xor eax, eax
mov ecx, ebx
add ecx, eax
mov cl, byte [ecx]
mov edi, dword [ebp + 0xc]
add edi, eax
mov byte [edi], cl
inc eax
dec edx
jne 0x4c1fc3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1fea
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14

Function at 0x4c4ed0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c4efe
mov eax, ebx
call fcn.004c5984
cmp dword [ebx + 0x40], 0
je 0x4c4ef7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c4f6f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c4f61
cmp dword [ebx + 8], 0
je 0x4c4f20
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c4f32
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c4f61
cmp dword [ebx + 8], 0
je 0x4c4f13
cmp eax, 3
je 0x4c4f45
dec eax
jne 0x4c4f13
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c4f13
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c4f13
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c4f8d
cmp dword [ebx + 0x14], 0xcc
je 0x4c4f8d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c4f98
pop ebx
ret
Function at 0x4201d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420229
test eax, edx
je 0x42022c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4201e7
movzx eax, word [eax]
sub eax, ecx
jmp 0x42020e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42020f
add ecx, 4
js 0x4201ff
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42020c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42020e
xor eax, eax
ret
test eax, eax
je 0x420238
test edx, edx
jne 0x4201d8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4298d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004081d4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040bc04
mov edi, eax
cmp edi, 0x104
jbe 0x429883
mov eax, edi
add eax, eax
call fcn.00404588
mov esi, eax
jmp 0x429885
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040bc04
push esi
call fcn.0040fb98
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4298be
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4298a8
mov eax, esp
cmp esi, eax
je 0x4298cb
mov eax, esi
call fcn.004045a4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x429904
cmp bl, 0
je 0x429900
cmp bl, 0x41
jl 0x4298fb
cmp bl, 0x5a
jg 0x4298fb
or bl, 0x20
xor al, bl
inc esi
jmp 0x4298df
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x429844
Function at 0x460ee4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46109f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004080f4
mov eax, dword [ebp - 4]
call fcn.00460834
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x460f36
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408ea0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00461b20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x461015
xor eax, eax
push ebp
push 0x46100e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00460ad4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004610d4
test al, al
je 0x460fec
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407e54
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x460fec
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00408a8c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040f2cc
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00460a34
test al, al
je 0x460fe6
mov eax, dword [ebp - 8]
call fcn.00408a8c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00408ae4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00460ee4
dec ebx
cmp ebx, 0xffffffff
jne 0x460f95
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461015
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00460ad4
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040f27c
ret
cmp byte [0x5cb078], 0
je 0x461055
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00408a8c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00460ac0
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00460a34
mov ebx, eax
jmp 0x46107c
mov eax, dword [ebp - 4]
call fcn.00408a8c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00460ac0
push eax
call fcn.0040f294
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00460a34
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4610a6
lea eax, [ebp - 0x3c]
call fcn.00407ccc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407d2c
ret

Function at 0x46b384
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46b38a
ret
Function at 0x476560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47670e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x4766ea
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x4766ea
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x476528]
call fcn.00409ef4
add esp, 4
lea eax, [ebp - 4]
call fcn.0040b574
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x5c4be0]
push eax
call sub.windowscodecs.dll_WICConvertBitmapSource
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00409d40
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.004050c4
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x469c48]
call fcn.00472ee8
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x4766c8
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00474b60
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
push 0
call fcn.0040fac8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00473b70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4766ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476715
lea eax, [ebp - 8]
mov edx, dword [0x476528]
call fcn.00409ff4
lea eax, [ebp - 4]
call fcn.0040b574
ret

Function at 0x4825ec
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x5c10ec
test edx, edx
jne 0x48260b
xor eax, eax
jmp 0x482729
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x482628
push esi
push edx
push eax
call fcn.00482730
add esp, 0xc
jmp 0x482729
push esi
push edx
push eax
call fcn.004829f0
add esp, 0xc
jmp 0x482729
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x527e04
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 1], al
mov byte [ebp - 2], 0
lea eax, [ebp - 8]
push eax
push 0x28
call fcn.0040f43c
push eax
call fcn.0040f274
test eax, eax
je 0x527e75
lea eax, [ebp - 0x14]
push eax
push 0x527e8c
push 0
call fcn.0040f26c
test eax, eax
je 0x527e75
mov dword [ebp - 0x18], 1
cmp byte [ebp - 1], 0
je 0x527e50
mov dword [ebp - 0xc], 2
jmp 0x527e57
mov dword [ebp - 0xc], 1
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0040f25c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp dword [ebp - 8], 0xffffffff
je 0x527e84
mov eax, dword [ebp - 8]
push eax
call fcn.0040f334
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret

Function at 0x52f5c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x40
mov eax, dword [ebp - 4]
push eax
call fcn.0040f650
test eax, eax
jne 0x52f626
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
jne 0x52f626
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x52f626
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0xf8
mov eax, dword [ebp - 8]
push eax
call fcn.0040f650
test eax, eax
jne 0x52f621
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x52f626
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret
Function at 0x545e04
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5cb528
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x545e26
shr eax, 1
xor eax, 0xedb88320
jmp 0x545e28
shr eax, 1
dec edx
jne 0x545e14
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x545e0d
mov byte [0x5cb928], 1
pop esi
pop ebx
ret

Function at 0x545e44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5cb928], 0
jne 0x545e5b
call fcn.00545e04
mov eax, edi
dec eax
test eax, eax
jl 0x545e83
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cb528]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x545e65
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x548b58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x548bf2.0
jmp dword [ecx*4 + 0x548b8b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x548bbd
sub dl, 8
je 0x548bcc
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548824
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548878
jmp case.0x548bf2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x548bf2.0
movzx ecx, byte [ecx + 0x548bf9]
jmp dword [ecx*4 + 0x548c0a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548918
jmp case.0x548bf2.0
cmp dl, 3
jne 0x548c37
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548970
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x54892c
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5489b4
jmp case.0x548bf2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x548c62
sub dl, 8
je 0x548c6e
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5489e0
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548a44
jmp case.0x548bf2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x548c8d
sub dl, 8
je 0x548c99
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548af4
jmp case.0x548bf2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x548b1c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x548d3b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00547d60
test eax, eax
je 0x548d3b
mov eax, ebx
call fcn.00548d44
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x548cd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8