joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a2b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ac78
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x34], esi
mov dword [esi + 0x10], 0
jb 0x40a317
mov eax, dword [esi]
jmp 0x40a319
mov eax, esi
push 0
push 0x47e551
mov byte [eax], 0
call fcn.004031e0
xor ecx, ecx
mov dword [ebp - 4], 0
mov eax, 0x101
mov dword [ebp - 0x18], 1
mov edx, 2
mov dword [ebp - 0x14], 0x100
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00478ee8
mov ecx, dword [ebp - 0x14]
add esp, 4
mov ebx, eax
add ecx, 1
je 0x40a372
xor eax, eax
mov edi, ebx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
cmp word [ebx], ax
jne 0x40a39a
xor ecx, ecx
jmp 0x40a3af
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a3a0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x30]
call fcn.004054f0
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00409120
mov edi, eax
cmp esi, edi
je 0x40a40b
mov edx, dword [esi + 0x14]
cmp edx, 0x10
jb 0x40a3e6
mov ecx, dword [esi]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40a3fe
mov eax, dword [esi]
jmp 0x40a400
mov eax, esi
push edi
mov ecx, esi
mov byte [eax], 0
call fcn.00403610
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x40a421
mov ecx, dword [ebp - 0x4c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
cmp edx, 8
jb 0x40a449
mov ecx, dword [ebp - 0x30]
inc edx
push 2
call fcn.004024a0
add esp, 4
push ebx
call fcn.00478ee3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret
Function at 0x40c1c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi + 0xc], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x40c205
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
pop esi
je 0x40c225
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push edi
push 0x40c2f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004787cb
mov esp, ebp
pop ebp
ret 4

Function at 0x40e940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b322
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push 0x104
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40e9be
mov eax, dword [esi]
jmp 0x40e9c0
mov eax, esi
mov byte [eax], 0
cmp byte [ebp - 0x118], 0
jne 0x40e9d0
xor ecx, ecx
jmp 0x40e9e9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e9e0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.004031e0
push 9
mov dword [ebp - 4], 0
mov ecx, esi
push str._system32
mov dword [ebp - 0x11c], 1
call fcn.00403400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret 4
Function at 0x40ea40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b372
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push 0x104
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40eac1
mov eax, dword [esi]
jmp 0x40eac3
mov eax, esi
mov byte [eax], 0
cmp byte [ebp - 0x118], 0
jne 0x40ead3
xor ecx, ecx
jmp 0x40eae9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40eae0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.004031e0
mov dword [ebp - 4], 0
mov ecx, esi
cmp byte [edi + 0xc], 0
mov dword [ebp - 0x11c], 1
je 0x40eb1a
push 0xa
push str._sysnative
jmp 0x40eb21
push 9
push str._system32
call fcn.00403400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret 4

Function at 0x40eb50
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x2a
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0
push eax
mov esi, ecx
push 0
mov dword [ebp - 0x10c], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x40eba7
xor ecx, ecx
jmp 0x40ebb9
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ebb0
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004031e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004787cb
mov esp, ebp
pop ebp
ret
Function at 0x4137a0
Capabilities:
Get logon sessions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ba1f
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
je 0x413814
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push str.LsaEnumerate_failed__lu
push str.windows_hook_helper
call fcn.00402500
add esp, 0xc
mov ecx, ebx
push 0x47e91c
call fcn.00405360
jmp 0x4138dd
push 0x47e91c
lea ecx, [ebp - 0x2c]
call fcn.00405360
xor esi, esi
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], esi
jle 0x4138a0
nop
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x4c]
lea edx, [eax + esi*8]
call fcn.00413620
mov edi, eax
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x41387a
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x41385d
mov ecx, dword [ebp - 0x2c]
inc edx
push 2
call fcn.004024a0
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004076f0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x413894
mov ecx, dword [ebp - 0x4c]
inc edx
push 2
call fcn.004024a0
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x4138a0
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x413830
push dword [ebp - 0x30]
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov word [ebx], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.004076f0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4138dd
mov ecx, dword [ebp - 0x2c]
inc edx
push 2
call fcn.004024a0
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret
Function at 0x416180
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bef8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push 0x3d
push str.SELECT_name_FROM_sqlite_master_WHERE_typetable_AND_name__
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.004031e0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4161fc
mov eax, dword [ecx]
jmp 0x4161fe
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.004032e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x416232
mov eax, dword [ecx]
jmp 0x416234
mov eax, ecx
push 0xffffffffffffffff
push 0
push edi
mov byte [eax], 0
call fcn.004032e0
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x2c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
je 0x416277
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x416273
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov al, 1
jmp 0x41628f
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x41628d
mov ecx, dword [ebp - 0x2c]
inc edx
push 1
call fcn.004024a0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret 4

Function at 0x41d5d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x41d5fd
nop dword [eax]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x483370]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x41d5e0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41d680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [edx*8]
mov ebx, ecx
cmp eax, 0x400
mov dword [ebp - 4], ebx
mov esi, 0x80
cmovbe esi, edx
push edi
cmp esi, dword [ebx]
jne 0x41d6af
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x492650]
test eax, eax
je 0x41d6ba
call eax
lea eax, [esi*8]
push eax
call fcn.00419f30
mov ecx, dword [0x492654]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x41d6db
call ecx
test esi, esi
je 0x41d6a6
push dword [ebx + 0xc]
call fcn.0041a240
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x491cb4]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x41d7be
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x41d74d
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x483370]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x41d730
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x41d798
mov eax, dword [esi]
test eax, eax
je 0x41d76b
mov edx, dword [esi + 4]
jmp 0x41d76d
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x41d798
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x41d78d
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x41d7b4
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x41d7b4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x41d7aa
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x41d724
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x41d934
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x41d924
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x483370]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x41d904
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x41d936
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.0041d7d0
add esp, 8
test eax, eax
je 0x41d950
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41d960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x41d9b5
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x41d9a5
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x483370]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x41d985
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x41d9ba
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.0041d7d0
add esp, 8
test eax, eax
je 0x41da02
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x41d9f2
push ebx
mov edx, eax
mov ecx, esi
call fcn.0041d880
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41daa0
push 0x14
call fcn.00419f30
mov edi, eax
add esp, 4
test edi, edi
jne 0x41da26
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x41da66
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x41da66
add edx, edx
mov ecx, esi
call fcn.0041d680
test eax, eax
je 0x41da66
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0041d5d0
xor edx, edx
div dword [esi]
jmp 0x41da69
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41da87
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.0041d610
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x41da96
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4250b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x14], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x4250fa
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4251d1
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x425133
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.00479b10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
test edi, edi
je 0x4251cf
mov ebx, dword [edi + 0x14]
cmp ebx, dword [esi + 0x18]
ja 0x4251c1
test byte [edi + 0x18], 0x20
jne 0x4251c1
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.00479b10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x42516f
mov ecx, edi
call fcn.004243a0
push dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x18]
mov edx, dword [edi + 4]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x4251a3
mov eax, dword [ebp - 0xc]
movups xmm0, xmmword [eax + 0x18]
movups xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x4251ab
mov dword [esi + 0x20], ebx
inc dword [esi + 0xa8]
mov edx, ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
call fcn.004334c0
add esp, 4
mov ebx, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x425133
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004787cb
mov esp, ebp
pop ebp
ret
Function at 0x44d450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, eax
test eax, eax
je 0x44d47f
cmp byte [eax], dl
je 0x44d477
inc edi
cmp byte [edi], dl
jne 0x44d472
sub edi, eax
and edi, 0x3fffffff
xor ebx, ebx
cmp dword [esi + 0x14], edx
jle 0x44d52b
nop word [eax + eax]
mov eax, ebx
mov ecx, ebx
xor eax, 1
cmp ebx, 2
cmovl ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x44d4fb
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x44d4dd
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x483370]
cmp cl, byte [edx + 0x483370]
jne 0x44d4dd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x44d4c0
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 8]
movzx ecx, byte [ecx + 0x483370]
movzx eax, byte [eax + 0x483370]
sub eax, ecx
jne 0x44d51e
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 0x10]
add ecx, ecx
mov edx, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0041d8e0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x44d52b
jmp 0x44d521
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x44d490
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push ebx
push edi
mov edi, eax
test eax, eax
je 0x44d67d
cmp byte [eax], dl
je 0x44d675
nop dword [eax]
inc edi
cmp byte [edi], dl
jne 0x44d670
sub edi, eax
and edi, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor ebx, ebx
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x44d729
push esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov eax, ebx
xor ecx, 1
cmp ebx, 2
cmovl eax, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x44d6fb
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x44d6e0
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x483370]
cmp cl, byte [edx + 0x483370]
jne 0x44d6dd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x44d6c0
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x483370]
movzx ecx, byte [ecx + 0x483370]
sub eax, ecx
jne 0x44d713
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea ecx, [eax + 0x18]
push edi
call fcn.0041d8e0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x44d720
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x44d694
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 8], esi
test edi, edi
je 0x44db31
test esi, esi
je 0x44d9e8
cmp dword [esi + 0x1f0], 0
jne 0x44d9f7
mov eax, 0xffff
add word [edi + 0x28], ax
jne 0x44db31
mov ebx, dword [edi + 8]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x44dae6
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
test esi, esi
je 0x44da1c
cmp dword [esi + 0x1f0], 0
jne 0x44dac0
mov esi, dword [ebx]
mov ecx, esi
mov dword [ebp - 0x14], esi
test esi, esi
je 0x44da3e
cmp byte [esi], 0
je 0x44da36
nop dword [eax]
inc ecx
cmp byte [ecx], 0
jne 0x44da30
sub ecx, esi
and ecx, 0x3fffffff
mov edi, dword [ebx + 0x18]
add edi, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44da97
xor edi, edi
mov dword [ebp - 0x10], esi
mov ebx, ecx
test ecx, ecx
je 0x44da83
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x483370]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x44da60
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
mov eax, edi
mov ebx, dword [ebp - 0xc]
xor edx, edx
mov edi, dword [ebp - 0x1c]
div dword [ebp - 0x18]
mov eax, edx
mov dword [ebp - 4], edx
jmp 0x44da9c
xor eax, eax
mov dword [ebp - 4], eax
push eax
push ecx
mov edx, esi
mov ecx, edi
call fcn.0041d7d0
add esp, 8
test eax, eax
je 0x44dabd
push dword [ebp - 4]
mov edx, eax
mov ecx, edi
call fcn.0041d880
add esp, 4
mov esi, dword [ebp - 8]
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.0041a2e0
mov edx, ebx
mov ecx, esi
call fcn.0041a2e0
mov eax, dword [ebp - 0x20]
mov ebx, eax
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x44da05
mov edi, dword [ebp - 0x24]
mov edx, edi
mov ecx, esi
call fcn.00457a10
mov edx, edi
mov ecx, esi
call fcn.0044d940
mov edx, dword [edi]
mov ecx, esi
call fcn.0041a2e0
mov edx, dword [edi + 0x14]
mov ecx, esi
call fcn.0041a2e0
mov edx, dword [edi + 0xc]
mov ecx, esi
call fcn.0045f0f0
mov edx, dword [edi + 0x18]
mov ecx, esi
call fcn.00446590
mov edx, edi
mov ecx, esi
call fcn.0046a500
mov edx, edi
mov ecx, esi
call fcn.0041a2e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret