joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f5c0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0xf9b4]
mov dword [esi + 0xf95c], 0x2580320
push ebx
push 0xb
mov dword [esi + 0xf960], 0x2580320
mov dword [esi + 0xf964], 0x2580320
mov dword [esi + 0xf968], 0
mov dword [esi + 0xf970], 0x3c
mov dword [esi + 0xffd0], 0
mov dword [esi + 0xffcc], 0
mov dword [esi + 0xf974], 1
mov dword [esi + 0xffd4], 0xffffffff
mov dword [esi + 0xf978], 0x20
mov dword [esi + 0xf97c], 0
mov dword [esi + 0xf980], 0
mov dword [esi + 0xf988], 0
mov dword [esi + 0xf98c], 1
mov dword [esi + 0xf990], 1
mov dword [esi + 0xf984], 1
mov dword [esi + 0xf998], 0
mov dword [esi + 0xf99c], 0
mov dword [esi + 0xf9a0], 0
mov dword [esi + 0xf9a4], 0
mov dword [esi + 0xf9a8], 1
mov dword [esi + 0xf9ac], 1
mov dword [esi + 0xf9b0], 1
mov dword [esi + 0xfffc], 1
mov dword [esi + 0x10000], 0
mov dword [esi + 0x10004], 0
mov dword [esi + 0x10018], 0
call fcn.0047a550
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add esp, 8
test eax, eax
jne 0x48f6f6
push ebx
push 0x104
call edi
lea ebx, [esi + 0xfbbc]
push ebx
push 5
call fcn.0047a550
add esp, 8
test eax, eax
jne 0x48f713
push ebx
push 0x104
call edi
lea ebx, [esi + 0xfdc4]
push ebx
push 0xb
call fcn.0047a550
add esp, 8
test eax, eax
jne 0x48f730
push ebx
push 0x104
call edi
push 0x4fff14
lea eax, [esi + 0x10034]
mov dword [esi + 0xffdc], 1
push eax
mov dword [esi + 0xffd8], 1
mov dword [esi + 0xffe0], 1
mov dword [esi + 0xffe4], 1
mov dword [esi + 0xffe8], 0
mov dword [esi + 0xffec], 1
mov dword [esi + 0xfff0], 0
mov dword [esi + 0xfff4], 0
mov dword [esi + 0xfff8], 0xffffffff
mov dword [esi + 0x10008], 0
mov dword [esi + 0x1000c], 0
mov dword [esi + 0x10010], 0
mov dword [esi + 0x10014], 1
mov dword [esi + 0x1001c], 0
mov dword [esi + 0x10020], 0
mov dword [esi + 0x10024], 0
mov dword [esi + 0x10028], 0
mov dword [esi + 0x1002c], 0
mov dword [esi + 0x10030], 0xffffffff
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
mov dword [esi + 0x100b4], 0x3f800000
mov dword [esi + 0x100b8], 0
pop esi
pop ebx
ret
Function at 0x48fab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb01b
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x428]
call fcn.0047de10
mov ecx, dword [0x5c3044]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x48fb3b
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 2
push eax
call fcn.00479620
add esp, 0x10
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x428]
push eax
call fcn.0047ee90
jmp 0x48fb8e
push 0x13
push 0
push ebx
call fcn.0046ddd0
mov dword [ebp - 0x42c], eax
test eax, eax
je 0x48fb8e
lea esi, [eax + 8]
push esi
call fcn.0046c16c
mov edi, eax
push esi
push edi
call fcn.00479960
mov ecx, dword [0x5c3044]
add esp, 0xc
push 0x13
push edi
push ebx
call fcn.0046ddd0
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x428]
push edi
call fcn.0047efb0
push edi
call fcn.00496c20
add esp, 4
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.0048fbf0
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.00491140
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.004914b0
lea ecx, [ebp - 0x428]
mov dword [ebp - 4], 0xffffffff
call fcn.0047de70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x4a2aab
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0049836d
mov dword [ebp - 0x14], eax
cmp dword [0x5c40d8], esi
jne 0x4a2b9e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4a2b2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a2c7e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4a2c7e
push 0x50636c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a2c7e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x5c40d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x5c40dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5c40e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c40e8], eax
test eax, eax
je 0x4a2b9b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c40e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4a2bc3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4a2bb6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4a2bd8
push 4
pop eax
jmp 0x4a2c80
cmp dword [ebp - 0x14], esi
je 0x4a2bd8
push dword [0x5c40d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4a2bbd
mov eax, dword [0x5c40e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4a2c36
cmp dword [0x5c40e8], edi
je 0x4a2c36
push eax
call ebx
push dword [0x5c40e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4a2c36
test eax, eax
je 0x4a2c36
call ecx
test eax, eax
je 0x4a2c2b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4a2c2b
test byte [ebp - 8], 1
jne 0x4a2c36
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4a2c66
mov eax, dword [0x5c40dc]
cmp eax, edi
je 0x4a2c63
push eax
call ebx
test eax, eax
je 0x4a2c63
call eax
mov esi, eax
test esi, esi
je 0x4a2c63
mov eax, dword [0x5c40e0]
cmp eax, edi
je 0x4a2c63
push eax
call ebx
test eax, eax
je 0x4a2c63
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5c40d8]
call ebx
test eax, eax
je 0x4a2c7e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4a2c80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x4a8030
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x5a2264]
cmp eax, 0x270
jl 0x46a765
cmp eax, 0x271
jne 0x46a6a4
push 0x1105
call fcn.0046a630
add esp, 4
xor edx, edx
jmp 0x46a6b0
mov ecx, dword [edx*4 + 0x5d06d4]
xor ecx, dword [edx*4 + 0x5d06d0]
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x5d06d0]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x559f08]
xor ecx, dword [edx*4 + 0x5d0d04]
mov dword [edx*4 + 0x5d06d0], ecx
inc edx
cmp edx, 0xe3
jl 0x46a6b0
cmp edx, 0x26f
jge 0x46a731
push esi
lea esi, [edx*4 + 0x5d06d0]
mov ecx, dword [esi]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x559f08]
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x5d108c
jl 0x46a700
pop esi
mov ecx, dword [0x5d06d0]
xor ecx, dword [0x5d108c]
and ecx, 0x7fffffff
xor ecx, dword [0x5d108c]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x559f08]
xor ecx, dword [0x5d0d00]
xor eax, eax
mov dword [0x5d108c], ecx
mov ecx, dword [eax*4 + 0x5d06d0]
inc eax
mov dword [0x5a2264], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
jmp 0x46a680
Function at 0x4aac90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ecx, [ecx]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x4aad1c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00496210
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4aacef
sub eax, esi
jmp 0x4aacf1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x4aace0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4aad0f
sub eax, esi
jmp 0x4aad11
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x4aad00
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x4aadd1
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x4aad49
xor eax, eax
jmp 0x4aad95
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4aad66
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004ada10
jmp 0x4aad76
cmp eax, 2
jne 0x4aad7f
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004add20
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.00496210
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x4aadbd
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x4aadd1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4aaca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4add20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4add2c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004adf20

Function at 0x4b1e20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4b1e52
push esi
call fcn.004b65c0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x4b1e4b
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x4b1ede
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x4b1ec8
lea ecx, [ecx]
mov eax, dword [esi + 8]
test eax, eax
je 0x4b1e7f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4b1ec2
cmp eax, 2
je 0x4b1ec8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b1e70
cmp eax, 3
je 0x4b1ea7
cmp eax, 1
jne 0x4b1e70
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4b1e70
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4b1e70
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004b1f10
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x4b1f00
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.004b1f10
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x4b1f10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x4b1f3e
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x4b1fc2
lea ebx, [esi + 0x78]
lea ecx, [ecx]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x4b1f96
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b1f75
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x184]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4b1fd9
cmp eax, dword [esi + 0x60]
jb 0x4b1f57
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
jne 0x4b1f50
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x4ccab0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [ebp - 0x18], esi
jne 0x4ccad6
mov eax, 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x4ccadb
xor eax, eax
mov byte [esi + 0x1c], al
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push edi
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 8], ebx
cmp dword [edi + 0x64], ebx
jle 0x4ccbdd
lea esp, [esp]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x4ccb2d
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
lea ecx, [ecx*2 - 2]
cdq
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov edx, eax
xor esi, esi
lea esp, [esp]
cmp esi, edx
jle 0x4ccb85
mov ecx, dword [ebp - 0x10]
imul eax, ebx, 0x1fe
lea edi, [ecx*2 - 2]
add ecx, 0xfe
add ecx, eax
lea esp, [esp]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x4ccb70
mov edi, dword [ebp - 0x14]
mov al, byte [ebp - 0xc]
imul bl
mov byte [esi + edi], al
inc esi
cmp esi, 0xff
jle 0x4ccb50
cmp dword [ebp - 4], 0
je 0x4ccbc4
mov ecx, 1
lea edx, [edi - 1]
movzx eax, byte [edi]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [edi + 0xff]
mov byte [edi + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x4ccba4
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0xc]
jl 0x4ccb10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 8
push esi
sub eax, ebx
mov edx, 1
push edi
mov ecx, eax
mov dword [ebp - 8], eax
mov edi, edx
mov esi, edx
shl edi, cl
mov ecx, 0x10
sub ecx, ebx
mov dword [ebp - 0xc], edi
shl esi, cl
mov ecx, 0xf
sub ecx, ebx
dec esi
mov ebx, dword [ebp + 8]
lea eax, [edi*4]
push eax
shl edx, cl
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], edx
call fcn.004e5110
mov ecx, dword [ebp + 0xc]
xor edi, edi
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ecx], eax
cmp dword [ebp - 0xc], edi
jbe 0x4dc2a7
mov eax, dword [ebp + 0x14]
add eax, 0xfffe8ce8
mov dword [ebp - 0x14], eax
push 0x200
push ebx
call fcn.004e52a0
mov ebx, eax
add esp, 8
cmp dword [ebp - 0x14], 0x2710
mov eax, dword [ebp - 0x10]
mov dword [eax + edi*4], ebx
jbe 0x4dc265
movsd xmm1, qword [0x55a018]
mov eax, esi
movd xmm0, esi
xor ecx, ecx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov esi, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
movd xmm2, dword [ebp + 0x14]
addsd xmm0, qword [eax*8 + 0x55a3b0]
cvtdq2pd xmm2, xmm2
divsd xmm1, xmm0
mulsd xmm2, qword [0x530c18]
movsd qword [ebp - 0x20], xmm1
movsd qword [ebp - 0x28], xmm2
lea esp, [esp]
mov eax, ecx
mov ecx, esi
shl eax, cl
add eax, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x55a3b0]
mulsd xmm0, xmm1
movaps xmm1, xmm2
call fcn.004f00b8
movsd xmm3, qword [0x530c50]
movapd xmm4, xmm0
mulsd xmm4, qword [0x530c28]
mov ecx, dword [ebp + 0xc]
movsd xmm1, qword [0x530c48]
addsd xmm4, qword [0x559f98]
andpd xmm3, xmm4
movapd xmm0, xmm4
xorpd xmm0, xmm3
movapd xmm2, xmm4
cmpltsd xmm0, xmm1
andpd xmm1, xmm0
orpd xmm1, xmm3
addsd xmm2, xmm1
subsd xmm2, xmm1
movsd xmm1, qword [0x55a018]
movapd xmm0, xmm2
subsd xmm0, xmm4
cmpnlesd xmm0, xmm3
andpd xmm0, xmm1
movsd xmm1, qword [ebp - 0x20]
subsd xmm2, xmm0
cvttsd2si eax, xmm2
movsd xmm2, qword [ebp - 0x28]
mov word [ebx + ecx*2], ax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 0x100
jb 0x4dc1b0
jmp 0x4dc297
mov ecx, dword [ebp - 8]
xor esi, esi
lea ebx, [ebx]
mov eax, esi
shl eax, cl
add eax, edi
cmp dword [ebp + 0x10], 0
je 0x4dc28a
imul eax, eax, 0xffff
xor edx, edx
add eax, dword [ebp - 0x18]
div dword [ebp - 4]
mov word [ebx + esi*2], ax
inc esi
cmp esi, 0x100
jb 0x4dc270
mov esi, dword [ebp - 4]
inc edi
mov ebx, dword [ebp + 8]
cmp edi, dword [ebp - 0xc]
jb 0x4dc141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, 8
mov edx, 1
sub eax, dword [ebp + 0x10]
mov edi, edx
mov ecx, eax
mov dword [ebp - 4], eax
shl edi, cl
mov ecx, 0x10
sub ecx, dword [ebp + 0x10]
shl edx, cl
dec edx
mov dword [ebp - 0x14], edi
lea eax, [edi*4]
mov dword [ebp - 0xc], edx
push eax
push dword [ebp + 8]
call fcn.004e5110
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add esp, 8
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ecx], ebx
test edi, edi
je 0x4dc31b
push 0x200
push dword [ebp + 8]
call fcn.004e52a0
mov dword [ebx + esi*4], eax
add esp, 8
inc esi
cmp esi, edi
jb 0x4dc303
xor esi, esi
xor eax, eax
mov dword [ebp + 0xc], eax
imul eax, eax, 0x101
movzx eax, ax
movzx ecx, ax
sub ecx, 0xffffff80
mov dword [ebp - 0x10], eax
lea eax, [ecx - 1]
cmp eax, 0xfffd
ja 0x4dc3e7
movd xmm1, dword [ebp + 0x14]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm0, qword [ecx*8 + 0x55a3b0]
mulsd xmm1, qword [0x530c18]
mulsd xmm0, qword [0x530c20]
call fcn.004f00b8
movsd xmm3, qword [0x530c50]
movapd xmm4, xmm0
mulsd xmm4, qword [0x530c28]
movsd xmm1, qword [0x530c48]
addsd xmm4, qword [0x559f98]
andpd xmm3, xmm4
movapd xmm0, xmm4
xorpd xmm0, xmm3
movapd xmm2, xmm4
cmpltsd xmm0, qword [0x530c48]
andpd xmm1, xmm0
orpd xmm1, xmm3
addsd xmm2, xmm1
subsd xmm2, xmm1
movsd xmm1, qword [0x55a018]
movapd xmm0, xmm2
subsd xmm0, xmm4
cmpnlesd xmm0, xmm3
andpd xmm0, xmm1
subsd xmm2, xmm0
cvttsd2si eax, xmm2
movzx eax, ax
jmp 0x4dc3ea
movzx eax, cx
movzx ecx, ax
mov eax, 0x80008001
imul ecx, dword [ebp - 0xc]
add ecx, 0x8000
mul ecx
mov edi, edx
shr edi, 0xf
inc edi
cmp esi, edi
jae 0x4dc42f
mov ecx, dword [ebp + 0x10]
mov ebx, 0xff
shr ebx, cl
mov ecx, dword [ebp - 4]
mov edx, esi
shr edx, cl
mov eax, ebx
mov ecx, dword [ebp - 8]
and eax, esi
inc esi
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
mov word [eax + edx*2], cx
cmp esi, edi
jb 0x4dc412
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, 0xff
jb 0x4dc322
mov edi, dword [ebp - 0x14]
shl edi, 8
cmp esi, edi
jae 0x4dc47d
mov ecx, dword [ebp + 0x10]
mov eax, 0xff
mov ebx, dword [ebp - 8]
sar eax, cl
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov edi, edi
and eax, esi
mov edx, esi
shr edx, cl
inc esi
mov ecx, 0xffff
mov eax, dword [ebx + eax*4]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp esi, edi
jb 0x4dc460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ddde0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x18]
mov dword [ebp - 8], 0
push dword [ebp + 0x1c]
push 1
call fcn.004e5180
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ddf9c
mov eax, dword [ebp - 4]
push 0x40
push 0x4f0b30
mov dword [eax + 0x280], VariantClear
mov eax, dword [ebp - 4]
mov dword [eax + 0x284], VariantClear
mov eax, dword [ebp - 4]
mov dword [eax + 0x288], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28c], 0
mov eax, dword [ebp - 4]
push eax
call fcn.004e58c0
push 0
push eax
call fcn.004f0bf0
add esp, 0x14
test eax, eax
je 0x4dde65
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.004e5360
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.004e58a0
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push eax
call fcn.004ddc60
add esp, 0x28
test eax, eax
jne 0x4ddea3
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4ddee7
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push eax
call fcn.004e52f0
mov ecx, dword [ebp - 4]
add esp, 8
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], 0
jne 0x4ddee7
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x4ddd60
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.004dddb0
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0
mov dword [eax + 0xa0], ecx
jne 0x4ddf6b
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.7
push eax
call fcn.004ad660
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x4ddf31.5
jmp dword [eax*4 + 0x4ddfe0]
push str.zlib_memory_error
jmp 0x4ddf52
push str.zlib_stream_error
jmp 0x4ddf52
push str.zlib_version_error
jmp 0x4ddf52
push str.Unknown_zlib_error
mov eax, dword [ebp - 4]
push eax
call fcn.004e58e0
mov dword [ebp - 8], 1
add esp, 8
cmp dword [ebp - 8], 0
je 0x4ddfa2
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
mov eax, dword [ebp - 4]
push eax
call fcn.004e5270
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], 0
mov eax, dword [ebp - 4]
push eax
call fcn.004e5210
add esp, 0x14
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push 0
push 0
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e4060
mov eax, dword [ebp - 4]
add esp, 0xc
mov esp, ebp
pop ebp
ret