joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dc095
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [esp + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [esp + 0x14], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
push 4
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.0043d9c0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x452f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dc05a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x30]
push eax
call fcn.004b88f2
mov eax, dword [edi + 0x1c]
lea esi, [edi + 0x14]
add esp, 4
push eax
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x4f42d8]
mov eax, dword [esi + 0xc]
push eax
call fcn.004b88f2
add esp, 4
push edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.00453930
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x454170
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dcbb3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov al, byte [ebx]
mov byte [esi], al
lea edi, [ebx + 4]
lea eax, [esi + 4]
call fcn.00443c70
mov dword [esp + 0x14], 0
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0x10], ecx
mov byte [esp + 0x14], 1
mov edx, dword [ebx + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
lea edi, [ebx + 0x1c]
lea eax, [esi + 0x1c]
call fcn.00443c70
mov cl, byte [ebx + 0x28]
mov byte [esi + 0x28], cl
mov edx, dword [ebx + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [ebx + 0x38]
mov dword [esi + 0x38], ecx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4595a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e36c8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, dword [edi + 0x248]
mov eax, dword [edi + 0x240]
mov eax, dword [eax + 4]
lea ecx, [edi + 0x240]
push edx
push ebx
call eax
lea esi, [edi + 0xc]
call fcn.00443290
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x3c]
or eax, 0xffffffff
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 4], 4
xor esi, esi
lea esp, [esp]
cmp esi, dword [ebp + 0x14]
jge 0x45976d
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + esi*4]
lea eax, [ebp - 0x1c]
call fcn.0043f050
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, dword [ebp - 0x18]
test edx, edx
jne 0x459671
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004b88f2
add esp, 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x1c]
mov eax, esi
shl eax, 4
add eax, dword [ebp + 0x10]
cmp word [ecx], 0x42
jne 0x459723
mov edi, 1
cmp edx, edi
jge 0x459695
test edx, edx
mov edi, edx
jle 0x4596ac
sub edx, edi
lea eax, [edx + edx + 2]
push eax
lea edx, [ecx + edi*2]
push edx
push ecx
call fcn.004bc4a0
add esp, 0xc
sub dword [ebp - 0x18], edi
lea ebx, [ebp - 0x2c]
lea edi, [ebp - 0x1c]
call fcn.00459530
mov edi, eax
test edi, edi
je 0x4596df
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b88f2
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
add eax, 0x240
call fcn.00454370
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b88f2
mov edi, dword [ebp + 8]
add esp, 4
add esi, 1
jmp 0x459620
push eax
lea edx, [edi + 0xc]
push edx
call fcn.004432f0
mov ebx, eax
test ebx, ebx
je 0x459755
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b88f2
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004b88f2
add esp, 4
add esi, 1
jmp 0x459620
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x466f10
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e35d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x5143ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x5143ac
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push str.crc.dat
lea ecx, [esp + 0x1c]
lea esi, [esp + 0x18]
mov edx, edi
mov dword [esp + 0x34], 0
call fcn.00467ab0
test eax, eax
jne 0x466fad
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466f97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x20
push str.qqpcmgr_pkg_crc_file
push ebx
call ebp
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
add edi, 0x1c
cmp edi, edi
mov edx, dword [edi + 4]
mov dword [esp + 0x24], edx
je 0x466fe0
call fcn.004b9c0e
cmp esi, dword [esp + 0x24]
je 0x467019
cmp esi, dword [edi + 4]
jne 0x466ff0
call fcn.004b9c0e
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x10]
push 0
lea edx, [esp + 0x20]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push ebx
mov dword [esp + 0x2c], ecx
call ebp
cmp esi, dword [edi + 4]
jne 0x467015
call fcn.004b9c0e
mov esi, dword [esi]
jmp 0x466fd0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467048
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x467ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4ae3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x5143ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x5143ac
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov edx, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x30]
lea esi, [esp + 0x18]
call fcn.00467ab0
test eax, eax
jne 0x467f6a
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467f63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x46801a
push 0x24
call fcn.004b9230
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x467f97
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
mov ecx, edi
call fcn.0046a5a0
mov esi, eax
jmp 0x467f99
xor esi, esi
mov byte [esp + 0x24], bl
mov edi, dword [esp + 0x14]
cmp edi, ebx
lea eax, [esi + 0xc]
jne 0x467fac
xor ecx, ecx
jmp 0x467fc0
mov ecx, edi
lea ebp, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x467fb1
sub ecx, ebp
sar ecx, 1
push edi
mov ebx, ecx
call fcn.00401450
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi]
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
test eax, eax
jne 0x467ff4
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [esp + 0x24], 0xffffffff
lea eax, [edi - 0x10]
jmp 0x467f4a
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x468018
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x468280
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov edi, ecx
push edi
push esi
push ebx
mov dword [esp + 0x20], 0
call ebp
test eax, eax
je 0x4682c0
mov eax, dword [esp + 0xc]
add esi, eax
sub edi, eax
je 0x4682c7
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push esi
push ebx
call ebp
test eax, eax
jne 0x4682a6
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x4682e0
Capabilities:
Create directory
Delete file
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4e2f98
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004099e0
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x468375
test al, 0x10
jne 0x4683d6
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x468375
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x46835f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x4683d6
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x4683d6
lea ecx, [esp + 0x14]
call fcn.00421540
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x4683ac
mov dword [esp + 0x20], ebp
jmp 0x468346
push eax
call fcn.004682e0
add esp, 4
test eax, eax
jne 0x4683c4
lea ecx, [esp + 0x14]
call fcn.00416ce0
jmp 0x46835f
push 0
push esi
call edi
test eax, eax
jne 0x4683d6
call ebx
cmp eax, 0xb7
jne 0x4683b9
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4683f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x46a320
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
mov esi, ecx
mov eax, dword [esi + 0xc]
push 1
push SysReAllocString
push eax
mov dword [esi + 0x1c], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46a397
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x46a388
cmp eax, 0x20
je 0x46a388
cmp eax, 2
je 0x46a379
cmp eax, 3
je 0x46a379
mov dword [esi + 0x1c], 0x6c
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
mov dword [esi + 0x1c], 0x6b
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
mov dword [esi + 0x1c], 0x67
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esi + 0x14]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebp
je 0x46a3b1
mov dword [esi + 0x1c], 0x64
jmp 0x46a404
push ebp
call fcn.004b74d1
mov ecx, dword [esi + 0x14]
add esp, 4
push 0
mov edi, eax
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46a3fd
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x46a3fd
push 0x517380
push eax
mov edx, edi
or ecx, 0xffffffff
call dword [0x5152d4]
not eax
cmp eax, dword [esi + 0x10]
je 0x46a404
mov dword [esi + 0x1c], 0x65
jmp 0x46a404
mov dword [esi + 0x1c], 0x6a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebp
je 0x46a419
push edi
call fcn.004b88f2
add esp, 4
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46abe0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
jne 0x46abe8
mov al, 1
ret
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x46ac0d
xor al, al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
Function at 0x46b460
Capabilities:
Set registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x22c]
push ebp
mov ebp, dword [esp + 0x22c]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov dword [esp + 0x14], eax
je 0x46b567
cmp ebp, esi
je 0x46b567
cmp dword [esp + 0x230], esi
je 0x46b567
push 0x206
lea ecx, [esp + 0x1e]
push esi
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x24], si
call fcn.004be320
add esp, 0xc
push 0xffffffffffffffff
push str.QMConfig
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.004b9c7c
push 0xffffffffffffffff
push 0x4f09a4
lea eax, [esp + 0x30]
push 0x104
push eax
call fcn.004bc834
push 0x103
push str.QQDoctorQQDoctorComCfg
lea ecx, [esp + 0x40]
push 0x104
push ecx
call fcn.004bc834
add esp, 0x30
push esi
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
call fcn.0046b1d0
test eax, eax
je 0x46b558
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46b567
mov esi, dword [esp + 0x23c]
mov edx, dword [esp + 0x14]
push esi
push edx
push 3
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x46b558
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [ebx], esi
je 0x46b554
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x46b56c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46b567
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004b84de
add esp, 0x220
ret 0x10
Function at 0x46b820
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x20c]
push ebp
mov ebp, dword [esp + 0x20c]
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
jne 0x46b868
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test edi, edi
jg 0x46b889
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
cmp dword [esp + 0x21c], 0
jne 0x46b8b0
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test eax, eax
jg 0x46b8d1
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test ebp, ebp
jne 0x46b8f0
pop edi
pop esi
lea eax, [ebp - 5]
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
mov ecx, dword [esp + 0x220]
test ecx, ecx
jg 0x46b918
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
cmp eax, ecx
jge 0x46b939
pop edi
pop esi
mov eax, 0xfffffff9
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
xor edx, edx
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x10c], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0xc], cl
add ecx, 1
idiv edi
cmp ecx, 0x100
jl 0x46b940
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x46b970
mov dl, byte [esp + eax + 0x10]
movzx esi, byte [esp + eax + 0x110]
movzx edi, dl
add esi, ecx
add edi, esi
mov ecx, edi
and ecx, 0x800000ff
jns 0x46b995
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + ecx + 0x10], dl
mov byte [esp + eax + 0x10], bl
add eax, 1
cmp eax, 0x100
jl 0x46b970
mov edx, dword [esp + 0x224]
xor esi, esi
xor ecx, ecx
test edx, edx
jle 0x46ba37
mov edi, dword [esp + 0x220]
mov eax, ebp
sub edi, ebp
mov ebp, edx
jmp 0x46b9d0
add ecx, 1
and ecx, 0x800000ff
jns 0x46b9e3
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x46b9fa
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x46ba24
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x46b9d0
mov ecx, dword [esp + 0x210]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004b84de
add esp, 0x204
ret
Function at 0x46ba60
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x20c]
push ebp
mov ebp, dword [esp + 0x20c]
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
jne 0x46baa8
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test edi, edi
jg 0x46bac9
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test ebp, ebp
jne 0x46bae8
pop edi
pop esi
lea eax, [ebp - 3]
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
test eax, eax
jg 0x46bb09
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
cmp dword [esp + 0x21c], 0
jne 0x46bb30
pop edi
pop esi
mov eax, 0xfffffffb
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
mov ecx, dword [esp + 0x220]
test ecx, ecx
jg 0x46bb58
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
cmp eax, ecx
jge 0x46bb79
pop edi
pop esi
mov eax, 0xfffffff9
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b84de
add esp, 0x204
ret
xor edx, edx
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x10c], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0xc], cl
add ecx, 1
idiv edi
cmp ecx, 0x100
jl 0x46bb80
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x46bbb0
mov dl, byte [esp + eax + 0x10]
movzx esi, byte [esp + eax + 0x110]
movzx edi, dl
add esi, ecx
add edi, esi
mov ecx, edi
and ecx, 0x800000ff
jns 0x46bbd5
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + ecx + 0x10], dl
mov byte [esp + eax + 0x10], bl
add eax, 1
cmp eax, 0x100
jl 0x46bbb0
mov edx, dword [esp + 0x224]
xor esi, esi
xor ecx, ecx
test edx, edx
jle 0x46bc77
mov edi, dword [esp + 0x220]
mov eax, ebp
sub edi, ebp
mov ebp, edx
jmp 0x46bc10
add ecx, 1
and ecx, 0x800000ff
jns 0x46bc23
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x46bc3a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x46bc64
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x46bc10
mov ecx, dword [esp + 0x210]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004b84de
add esp, 0x204
ret
Function at 0x475620
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4e31b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov eax, 0x4ef7d8
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x475663
sub eax, edx
sar eax, 1
push eax
push 0x4ef7d8
lea esi, [esp + 0x1c]
call fcn.004024d0
push 0xffffffffffffffff
push ebx
mov eax, esi
mov ecx, edi
mov dword [esp + 0x40], ebx
call fcn.00402090
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x4756ad
mov eax, dword [esp + 0x18]
push eax
call fcn.004b84d9
add esp, 4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
call fcn.0047c1c0
push edi
mov dword [edi + 0x1c], ebx
call fcn.00475710
cmp dword [edi + 0x1c], ebx
je 0x4756d7
push edi
call fcn.00475a80
mov ecx, edi
call fcn.00476260
mov ecx, edi
call fcn.00476d70
mov ecx, edi
call fcn.00476aa0
mov ecx, edi
call fcn.00476620
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret