joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add ecx, 0x4c
mov word [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ecx + 0x14], 8
jb 0x45ca6e
mov ecx, dword [ecx]
push 0x5b5d78
push ecx
lea eax, [ebp - 8]
push eax
call fcn.0051d2de
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x45cac7
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.00521711
push dword [ebp - 8]
call fcn.00518f1e
mov cl, byte [ebp - 4]
add esp, 0x14
mov al, byte [ebp - 3]
cmp cl, 0xff
jne 0x45caaf
cmp al, 0xfe
je 0x45cab8
cmp al, 0xff
jne 0x45cac1
cmp cl, 0xfe
jne 0x45cac1
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x45cad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x45cb08
call fcn.0045ca50
test al, al
jne 0x45cb08
mov eax, dword [ebx]
test eax, eax
je 0x45cb01
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.0045dab0
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x45cb15
mov eax, dword [esi]
jmp 0x45cb17
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x45cbaf
cmp dword [esi + 0x14], 8
jb 0x45cb3f
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x45cb6a
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
lea ecx, [ebp - 4]
push 0
push ecx
jne 0x45cb98
push 2
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0xfeff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
lea ecx, [ebp + 8]
mov word [ebp + 8], 0xbbef
push ecx
push eax
mov byte [ebp + 0xa], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45cbc0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578f26
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45ccc5
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x45cc3e
xor ecx, ecx
jmp 0x45cc56
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45cc47
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0044d430
xor bl, bl
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
push 0
cmovae eax, dword [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x45cc9a
cmp eax, 0xb7
je 0x45cc9a
cmp eax, 0x50
jne 0x45cc9c
mov bl, 1
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x45ccba
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.0044d810
test bl, bl
jne 0x45ccc5
xor al, al
jmp 0x45cde6
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x45ccef
xor ecx, ecx
jmp 0x45cd0f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45cd00
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0044d430
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
cmp word [esi], ax
jne 0x45cd4f
xor ecx, ecx
jmp 0x45cd63
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45cd54
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x260]
call fcn.0044d430
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00464560
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x24c]
cmp ecx, 8
jb 0x45cda9
inc ecx
push ecx
push dword [ebp - 0x260]
lea ecx, [ebp - 0x260]
call fcn.0044d810
test bl, bl
je 0x45cdc6
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x248]
cmp ecx, eax
je 0x45cdc4
push 0xffffffffffffffff
push 0
push eax
call fcn.0044d8f0
mov bl, 1
mov ecx, dword [ebp - 0x234]
cmp ecx, 8
jb 0x45cde4
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.0044d810
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
Function at 0x45d000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45d010
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x5b5d94
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45d070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x45d080
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
push 0x5b4554
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45dab0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5790e0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
lea esi, [edi + 0x4c]
mov dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
call fcn.0044d8f0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00464610
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00464440
lea eax, [ebp - 0x58]
mov edx, 0x5b5e28
push eax
lea ecx, [ebp - 0x70]
call fcn.004609a0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004504a0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x45db69
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.0044d810
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.004648a0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004646a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x45dbf5
cmp dword [esi + 0x10], 0
je 0x45dbf5
cmp dword [ebp - 0x18], 0
je 0x45dbf5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x45dbcc
mov esi, dword [esi]
push eax
push esi
call fcn.005293bd
add esp, 8
test eax, eax
jne 0x45dbf5
lea ecx, [edi + 0x98]
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x45dbf1
push 0xffffffffffffffff
push 0
push eax
call fcn.0044d8f0
mov bl, 1
jmp 0x45dbf7
xor bl, bl
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x45dc0c
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0044d810
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x45dc35
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.0044d810
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp ecx, 8
jb 0x45dc5e
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0044d810
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x460600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578506
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5df3f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0050ada4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0050caf7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x463a30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x463a4b
mov eax, dword [edi]
jmp 0x463a4d
mov eax, edi
mov ecx, dword [ebp + 8]
mov byte [eax], 0
test ecx, ecx
je 0x463baa
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x463baa
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 8], al
inc ecx
mov ah, byte [ebp - 6]
inc esi
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
mov dword [ebp + 8], ecx
mov byte [ebp - 2], ah
mov byte [ebp + 0x13], dl
mov byte [ebp - 1], dh
cmp esi, 3
jne 0x463ae7
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0xc], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0xb], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], al
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0xc]
mov ecx, edi
movzx eax, byte [eax + 0x5b0bb0]
push eax
push 1
call fcn.00454960
inc esi
cmp esi, 4
jl 0x463ac0
mov ecx, dword [ebp + 8]
xor esi, esi
mov dl, byte [ebp + 0x13]
mov dh, byte [ebp - 1]
test ebx, ebx
jne 0x463a66
mov dword [ebp + 8], esi
test esi, esi
je 0x463ba0
mov eax, esi
cmp esi, 3
jge 0x463b20
cmp eax, 3
jae 0x463bb3
mov byte [ebp + eax - 8], 0
inc eax
cmp eax, 3
jl 0x463b04
mov cl, byte [ebp - 6]
mov dl, byte [ebp - 7]
mov dh, byte [ebp - 8]
jmp 0x463b23
mov cl, byte [ebp - 2]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 0xc], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 0xb], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 9], cl
lea eax, [esi + 1]
mov byte [ebp - 0xa], dl
mov dword [ebp + 0x10], eax
test eax, eax
jle 0x463b7e
mov esi, eax
nop
movzx eax, byte [ebp + ebx - 0xc]
mov ecx, edi
movzx eax, byte [eax + 0x5b0bb0]
push eax
push 1
call fcn.00454960
inc ebx
cmp ebx, esi
jl 0x463b60
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x463ba0
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.00454960
sub ebx, 1
jne 0x463b90
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0050b4a4
int3
Function at 0x464b10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor bl, bl
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
mov dword [ebp - 0x10], edi
jb 0x464b2d
mov eax, dword [esi]
jmp 0x464b2f
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x464b5b
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x464b7a
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x464b86
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x464bfa
cmp dword [ebp - 4], 0
jl 0x464bfa
jg 0x464ba4
cmp dword [ebp - 8], 0xa00000
jb 0x464bfa
mov eax, dword [edi + 0x68]
add edi, 0x68
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x464bb7
push eax
call ebx
cmp dword [esi + 0x14], 8
jb 0x464bbf
mov esi, dword [esi]
push 0
push 0x80
push 5
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
test eax, eax
je 0x464be7
push eax
call ebx
mov dword [edi], 0
mov ecx, dword [ebp - 0x10]
push edi
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x464c10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x464c5e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x464c5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x464c5b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
cmp dword [esi], 0
mov ecx, dword [ebp + 0x1c]
setne bl
cmp ecx, 8
jb 0x464c76
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0044d810
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x18

Function at 0x4652e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x4652f2
xor edi, edi
nop
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x465300
pop edi
pop esi
pop ebx
ret
Function at 0x465340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4653cb
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4653cb
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4653cb
mov dl, byte [esi + 0x101]
sub ecx, edi
push ebx
mov bh, byte [esi + 0x100]
mov byte [ebp + 0xf], dl
mov dword [ebp + 8], ecx
dec eax
lea edi, [edi + 1]
mov dword [ebp + 0x10], eax
inc bh
mov al, byte [ebp + 0xf]
movzx edx, bh
mov bl, byte [edx + esi]
add al, bl
movzx ecx, al
mov byte [ebp + 0xf], al
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
mov byte [ecx + esi], bl
movzx eax, byte [edx + esi]
mov ecx, dword [ebp + 8]
add al, bl
movzx eax, al
movzx eax, byte [eax + esi]
xor al, byte [ecx + edi - 1]
mov byte [edi - 1], al
mov eax, dword [ebp + 0x10]
test eax, eax
jg 0x465371
mov dl, byte [ebp + 0xf]
mov al, 1
mov byte [esi + 0x100], bh
pop ebx
pop edi
mov byte [esi + 0x101], dl
pop esi
pop ebp
ret 0xc
pop edi
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x4653e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465340

Function at 0x4653f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x46544b
push ebx
push esi
push edi
mov edi, 0x5b0e20
mov byte [edx], 0xd0
mov ebx, 0x5b0e21
lea eax, [edx + 1]
mov ecx, 0x5b0e22
sub edi, edx
sub ebx, edx
mov esi, 0x15
sub ecx, edx
mov dword [ebp + 8], ecx
movzx ecx, byte [edi + eax]
lea eax, [eax + 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 1], cl
sub esi, 1
jne 0x465420
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4

Function at 0x465460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4654bb
push ebx
push esi
push edi
mov edi, 0x5b0c38
mov byte [edx], 0xbd
mov ebx, 0x5b0c39
lea eax, [edx + 1]
mov ecx, 0x5b0c3a
sub edi, edx
sub ebx, edx
mov esi, 0x15
sub ecx, edx
mov dword [ebp + 8], ecx
movzx ecx, byte [edi + eax]
lea eax, [eax + 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 1], cl
sub esi, 1
jne 0x465490
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4
Function at 0x4654d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x465548
push ebx
push esi
mov ecx, str.1e210
mov byte [edx], 0x30
sub ecx, edx
lea eax, [edx + 1]
push edi
mov dword [ebp + 8], ecx
mov edi, 0x5b0c78
mov ebx, 0x5b0c79
mov ecx, 0x5b0c7b
sub edi, edx
sub ebx, edx
sub ecx, edx
mov esi, 0x56
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx ecx, byte [edi + eax]
lea eax, [eax + 4]
xor cl, byte [edx]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 1], cl
sub esi, 1
jne 0x465510
pop edi
pop esi
pop ebx
mov eax, 0x159
mov esp, ebp
pop ebp
ret 4
Function at 0x465590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push 1
mov dword [ebp - 0x18], eax
mov esi, ecx
lea eax, [ebp - 0x14]
push 0xe
push eax
call fcn.00521711
add esp, 0x10
cmp eax, 1
je 0x4655d5
mov eax, 0xfffffffe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
mov cl, byte [ebp - 0x14]
mov ch, byte [ebp - 0x13]
mov edx, dword [ebp - 0x12]
mov eax, dword [ebp - 0xa]
mov byte [esi], cl
mov byte [esi + 1], ch
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
push ebx
mov bx, word [ebp - 0xe]
mov word [esi + 8], bx
push edi
mov di, word [ebp - 0xc]
mov word [esi + 0xa], di
cmp cl, 0x42
jne 0x46573c
cmp ch, 0x4d
jne 0x46573c
test bx, bx
jne 0x46573c
test di, di
jne 0x46573c
cmp edx, 0x36
jbe 0x46573c
cmp edx, 0x1e8480
ja 0x46573c
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x465647
push eax
call fcn.00524165
add esp, 4
push dword [esi + 4]
call fcn.0052416a
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x465671
pop edi
pop ebx
mov eax, 0xfffffff9
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
xor edx, edx
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x14]
mov byte [edx + ecx], al
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x13]
mov byte [ecx + edx + 1], al
add edx, 2
cmp edx, 0xe
jl 0x465673
push dword [ebp - 0x18]
mov eax, dword [esi + 4]
sub eax, 0xe
push 1
push eax
mov eax, dword [esi + 0x3c]
add eax, 0xe
push eax
call fcn.00521711
add esp, 0x10
cmp eax, 1
je 0x4656b7
push dword [esi + 0x3c]
jmp 0x46572d
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + 0xe]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x12]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x16]
mov dword [esi + 0x18], eax
movzx eax, word [ecx + 0x1a]
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], 1
movzx eax, word [ecx + 0x1c]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x1e]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x22]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x26]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx + 0x2a]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 0x2e]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0x32]
mov dword [esi + 0x38], eax
jne 0x46572c
cmp dword [esi + 0x24], 0
jne 0x46572c
mov eax, dword [esi + 0x20]
cmp eax, 0x18
je 0x465717
cmp eax, 0x20
jne 0x46572c
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
push ecx
call fcn.00524165
mov dword [esi + 0x3c], 0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 4
Function at 0x465760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov edx, dword [edi + 0x3c]
test edx, edx
jne 0x465797
lea eax, [edx - 3]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x4657b4
lea eax, [ebx - 4]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8
mov ecx, ebx
push esi
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4657c0
mov eax, dword [edi + 0x18]
sub ecx, esi
imul eax, dword [edi + 0x14]
inc ecx
mov dword [ebp - 0x10], ecx
lea eax, [eax + eax*2]
cmp ecx, eax
jbe 0x4657f3
pop esi
pop ebx
mov eax, 0xfffffffb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x20]
xor ecx, ecx
mov edi, dword [edi + 0xc]
xor esi, esi
add edi, edx
shr eax, 3
xor edx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x8040201
mov dword [ebp - 8], 0x80402010
cmp dword [ebp - 0x10], ecx
jbe 0x465866
nop word [eax + eax]
mov al, byte [esi + ebx]
test byte [ebp + edx - 0xc], al
mov al, byte [ecx + edi]
jne 0x465834
test al, 1
je 0x46583d
dec al
jmp 0x46583a
test al, 1
jne 0x46583d
inc al
mov byte [ecx + edi], al
inc ecx
cmp dword [ebp - 0x14], 4
jne 0x465858
mov eax, ecx
and eax, 0x80000003
jns 0x465852
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x465858
inc ecx
inc edx
cmp edx, 8
jne 0x465861
xor edx, edx
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x465820
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push 1
push dword [eax + 4]
push dword [eax + 0x3c]
call fcn.00528ceb
mov ecx, dword [ebp - 4]
add esp, 0x10
dec eax
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
pop ebx
and eax, 0xfffffffa
pop edi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8