joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442240
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44242f
sub esp, 0x3c
mov edi, dword [esp + 0x40]
mov ecx, dword [edi + 4]
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xe9
xchg ebp, eax
jne 0x442287
mov ebp, dword [edi + 4]
add ebp, 5
mov dword [esp + 0xc], ebp
mov esi, ecx
inc esi
mov eax, dword [esi]
cdq
mov ebx, dword [esp + 0xc]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xeb
xchg ebp, eax
jne 0x4422b2
mov ebp, dword [edi + 4]
add ebp, 2
mov dword [esp + 8], ebp
mov eax, ecx
inc eax
movzx eax, byte [eax]
movsx eax, al
cdq
mov ebx, dword [esp + 8]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xcc
xchg ebp, eax
jne 0x4422c0
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
movzx ebp, byte [ecx + 1]
xor edx, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
movzx ebp, byte [ecx + 2]
xor edx, edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edx
movzx ebp, byte [ecx + 3]
xor edx, edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], ecx
movzx ebp, byte [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
call fcn.0042a090
mov ebx, 0x5f06e1
mov dword [esp], ebx
mov dword [esp + 4], 0xc
call fcn.0042aaa0
mov ebx, dword [esp + 0x38]
mov dword [esp], ebx
call fcn.0042aa60
mov ebx, 0x5ee504
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee504
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee504
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee504
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee504
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee526
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
call fcn.0042a110
mov ebx, 0x5f7745
mov dword [esp], ebx
mov dword [esp + 4], 0x22
call fcn.004298b0
add esp, 0x3c
ret
call fcn.004501c0
jmp fcn.00442240
Function at 0x444860
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44495a
sub esp, 0x3c
mov esi, dword [esp + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [esi + 0x90], edx
mov dword [esi + 0x94], ecx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [esi + 0x98], eax
mov dword [esp], 0x5b6700
call fcn.0040dd70
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [eax], ecx
mov edx, 1
mov ecx, 1
mov ebx, 0x6c7b60
mov dword [esp], ebx
add dword [esp], 0x54
mov dword [esp + 0x30], eax
mov dword [esp + 4], eax
mov dword [esp + 0x34], edx
mov dword [esp + 8], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0xc], ecx
call fcn.00443fe0
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x40]
mov esi, dword [ebx + 0x64]
mov ebp, dword [ebx + 0x68]
mov dword [eax], esi
mov dword [eax + 4], ebp
mov ebp, edx
xor edx, edx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edx
mov edx, 2
mov ecx, 2
mov byte [esp], 0xd
mov dword [esp + 4], 2
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ecx
call fcn.004437f0
add esp, 0x3c
ret
call fcn.004501c0
jmp fcn.00444860
Function at 0x444d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x444e9e
sub esp, 0x48
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
cmp edi, 0
jne 0x444dab
cmp esi, 0
je 0x444dc5
mov edx, dword [0x6c7b78]
mov eax, dword [0x6c7b7c]
cmp eax, edi
jl 0x444dc5
jg 0x444dc1
cmp edx, esi
jbe 0x444dc5
xor esi, esi
xor edi, edi
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov ecx, dword [ebp + 0x4c]
mov eax, dword [ecx + 0x90]
mov edx, dword [ecx + 0x94]
add eax, 1
adc edx, 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov ebp, dword [ecx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [ecx + 0x98], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
lea ebp, [esp + 0x24]
mov eax, dword [ecx + 0x64]
mov dword [esp + 0x1c], eax
mov edx, dword [ecx + 0x68]
mov eax, dword [esp + 0x1c]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov edx, dword [ecx + 0x90]
mov ecx, dword [ecx + 0x94]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edi
mov eax, esi
mov edx, edi
shrd eax, edi, 6
shr edx, 6
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov edx, 3
mov ecx, 3
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
mov dword [esp + 0x3c], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x10], ecx
call fcn.004437f0
add esp, 0x48
ret
call fcn.004501c0
jmp fcn.00444d80
Function at 0x451870
Capabilities:
Access peb ldr_data

Disassembly:
push eax
push ebx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea eax, [esp + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [eax - 4]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
pop ebx
pop eax
ret

Function at 0x451b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x451bc0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6cfec0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x451dc2
je 0x451daa
cmp ebx, 0x20
jbe 0x451d6c
cmp ebx, 0x40
jbe 0x451cdb
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6cfed0]
pxor xmm2, xmmword [0x6cfee0]
pxor xmm3, xmmword [0x6cfef0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x451c61
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6cfed0]
pxor xmm2, xmmword [0x6cfee0]
pxor xmm3, xmmword [0x6cfef0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
pxor xmm1, xmmword [0x6cfed0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqu xmm1, xmmword [eax]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
test ebx, ebx
je 0x451df5
add eax, 0x10
test ax, 0xff0
je 0x451de1
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x613400]
jmp 0x451dae
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x613500]
jmp 0x451dae
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
Function at 0x452d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x24c
mov dword [esp], esp
mov dword [esp + 4], 0x24c
call fcn.004527d0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xe4
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xe4
call fcn.004527d0
lea ebx, [esp + 0xe4]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xad0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4600c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4602c7
sub esp, 0x74
xor ebx, ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov ebx, dword [esp + 0x78]
mov ebp, dword [ebx + 0xc]
cmp ebp, 0
je 0x460189
mov ebx, dword [esp + 0x78]
cmp ebx, 0
je 0x4602c0
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ebx, dword [esp + 0x7c]
mov ebp, dword [ebx + 8]
mov dword [esp + 4], ebp
mov dword [esp + 0x4c], eax
mov dword [esp], eax
mov dword [esp + 0x48], ecx
mov ebx, dword [ecx + 0x14]
call ebx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x64], ecx
xor ecx, ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], edx
mov eax, edx
mov ebp, dword [esp + 0x28]
cmp ecx, ebp
jge 0x460189
mov dword [esp + 0x34], eax
mov ebp, dword [eax]
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
mov dword [esp + 4], ebp
call fcn.0047cc40
mov eax, dword [esp + 0x34]
add eax, 4
mov ecx, dword [esp + 0x2c]
inc ecx
mov ebp, dword [esp + 0x28]
cmp ecx, ebp
jl 0x46015b
mov eax, dword [esp + 0x78]
xor ebx, ebx
mov ebp, dword [eax]
cmp ebp, 0
je 0x4602af
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x80]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x18], ebx
call fcn.004604b0
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], eax
cmp eax, 0
je 0x460221
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
add esp, 0x74
ret
mov ebx, dword [esp + 0x78]
mov ebp, dword [ebx + 0xc]
cmp ebp, 0
je 0x46028c
mov ebx, dword [esp + 0x30]
mov dword [esp], ebx
call fcn.0047e750
mov esi, dword [esp + 4]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp eax, 0
jle 0x46028c
mov ebx, dword [esp + 0x78]
cmp ebx, 0
je 0x4602ab
mov edi, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov ebx, dword [esp + 0x7c]
mov ebp, dword [ebx + 8]
mov dword [esp + 4], ebp
mov dword [esp + 0x50], esi
mov dword [esp + 8], esi
mov dword [esp + 0x54], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x58], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x4c], ecx
mov dword [esp], ecx
mov dword [esp + 0x48], edi
mov ebx, dword [edi + 0x18]
call ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x90], ebx
xor ebx, ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
add esp, 0x74
ret
mov dword [ebx], eax
jmp 0x460253
mov ecx, dword [0x6be4e0]
mov eax, dword [0x6be4e4]
jmp 0x46019f
mov dword [ebx], eax
jmp 0x460106
call fcn.004501c0
jmp fcn.004600c0
Function at 0x4f4160
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f4356
mov edx, dword [esp + 8]
movzx ecx, byte [esp + 4]
cmp cl, 0x41
jb 0x4f418f
cmp cl, 0x5a
ja 0x4f418f
mov byte [esp + 0xc], 0
ret
cmp cl, 0x61
jb 0x4f4199
cmp cl, 0x7a
jbe 0x4f4189
cmp cl, 0x30
jb 0x4f41a3
cmp cl, 0x39
jbe 0x4f4189
cmp edx, 2
je 0x4f42a4
cmp edx, 3
je 0x4f42a4
cmp cl, 0x2f
ja 0x4f4257
cmp cl, 0x2b
ja 0x4f4232
cmp cl, 0x24
jne 0x4f4226
cmp edx, 4
jg 0x4f4210
cmp edx, 1
jne 0x4f41e4
cmp cl, 0x3f
je 0x4f41dd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x4f41dc
cmp edx, 4
jne 0x4f420a
cmp cl, 0x40
je 0x4f4203
cmp cl, 0x2f
je 0x4f4203
cmp cl, 0x3f
je 0x4f4203
cmp cl, 0x3a
je 0x4f4203
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x4f4202
mov byte [esp + 0xc], 1
ret
cmp edx, 5
jne 0x4f421b
mov byte [esp + 0xc], 1
ret
cmp edx, 6
jne 0x4f420a
mov byte [esp + 0xc], 0
ret
cmp cl, 0x26
je 0x4f41c8
cmp cl, 0x2b
je 0x4f41c8
jmp 0x4f420a
cmp cl, 0x2d
ja 0x4f4247
cmp cl, 0x2c
je 0x4f41c8
cmp cl, 0x2d
jne 0x4f420a
mov byte [esp + 0xc], 0
ret
cmp cl, 0x2e
je 0x4f4241
cmp cl, 0x2f
je 0x4f41c8
jmp 0x4f420a
cmp cl, 0x3d
ja 0x4f4279
cmp cl, 0x3a
je 0x4f41c8
cmp cl, 0x3b
je 0x4f41c8
cmp cl, 0x3d
je 0x4f41c8
jmp 0x4f420a
cmp cl, 0x40
ja 0x4f4295
cmp cl, 0x3f
je 0x4f41c8
cmp cl, 0x40
je 0x4f41c8
jmp 0x4f420a
cmp cl, 0x5f
je 0x4f4241
cmp cl, 0x7e
je 0x4f4241
jmp 0x4f420a
cmp cl, 0x2a
ja 0x4f42fa
cmp cl, 0x26
ja 0x4f42d7
cmp cl, 0x22
ja 0x4f42c8
cmp cl, 0x21
jne 0x4f42be
mov byte [esp + 0xc], 0
ret
cmp cl, 0x22
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x24
je 0x4f42b8
cmp cl, 0x26
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x28
ja 0x4f42eb
cmp cl, 0x27
je 0x4f42b8
cmp cl, 0x28
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x29
je 0x4f42b8
cmp cl, 0x2a
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x3b
ja 0x4f4322
cmp cl, 0x2c
ja 0x4f4313
cmp cl, 0x2b
je 0x4f42b8
cmp cl, 0x2c
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x3a
je 0x4f42b8
cmp cl, 0x3b
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x3d
ja 0x4f4336
cmp cl, 0x3c
je 0x4f42b8
cmp cl, 0x3d
je 0x4f42b8
jmp 0x4f41b5
cmp cl, 0x3e
je 0x4f42b8
cmp cl, 0x5b
je 0x4f42b8
cmp cl, 0x5d
je 0x4f42b8
jmp 0x4f41b5
call fcn.004501c0
jmp fcn.004f4160
Function at 0x4f6a50
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f6b99
sub esp, 0x10
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, ecx
cmp ecx, edx
jge 0x4f6aa4
cmp ecx, edx
jae 0x4f6b92
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
cmp bl, 0x2a
ja 0x4f6b27
cmp bl, 0x26
ja 0x4f6b06
cmp bl, 0x24
ja 0x4f6afa
cmp bl, 0x21
jne 0x4f6aad
inc ecx
cmp ecx, edx
jl 0x4f6a77
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
cmp bl, 0x24
je 0x4f6a9f
mov dword [esp + 0xc], ecx
cmp ecx, edx
jae 0x4f6af3
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
mov byte [esp], bl
mov dword [esp + 4], 1
call fcn.004f4160
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
movzx ebx, byte [esp + 8]
cmp bl, 0
je 0x4f6af1
mov byte [esp + 0x1c], 0
add esp, 0x10
ret
jmp 0x4f6a9f
call fcn.00427bf0
ud2
cmp bl, 0x25
je 0x4f6a9f
cmp bl, 0x26
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x28
ja 0x4f6b17
cmp bl, 0x27
je 0x4f6a9f
cmp bl, 0x28
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x29
je 0x4f6a9f
cmp bl, 0x2a
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x3b
ja 0x4f6b5f
cmp bl, 0x2c
ja 0x4f6b48
cmp bl, 0x2b
je 0x4f6a9f
cmp bl, 0x2c
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x3a
je 0x4f6a9f
cmp bl, 0x3b
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x40
ja 0x4f6b7b
cmp bl, 0x3d
je 0x4f6a9f
cmp bl, 0x40
je 0x4f6a9f
jmp 0x4f6ab2
cmp bl, 0x5b
je 0x4f6a9f
cmp bl, 0x5d
je 0x4f6a9f
jmp 0x4f6ab2
call fcn.00427bf0
ud2
call fcn.004501c0
jmp fcn.004f6a50
Function at 0x54b930
Capabilities:
Encrypt data using des

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54badd
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 8
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jge 0x54ba9b
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
xor ecx, ecx
cmp ecx, 4
jge 0x54ba82
xor eax, eax
cmp eax, 0x10
jge 0x54ba78
mov ebx, dword [esp + 0x1c]
mov edi, 7
sub edi, ebx
mov ebx, dword [esp + 0x1c]
mov ebp, 0x6adf80
cmp ebx, 8
jae 0x54bad6
shl ebx, 6
add ebp, ebx
mov dword [esp + 0x24], ecx
mov ebx, ecx
mov esi, ebp
cmp ecx, 4
jae 0x54bacf
shl ebx, 4
add esi, ebx
mov dword [esp + 0x20], eax
mov ebp, esi
cmp eax, 0x10
jae 0x54bac8
add ebp, eax
movzx ebx, byte [ebp]
xor edx, edx
mov eax, ebx
mov ecx, edi
shl ecx, 2
cmp ecx, 0x40
jae 0x54babf
cmp ecx, 0x20
jae 0x54bab4
shld edx, eax, cl
shl eax, cl
mov ecx, edx
mov edx, 0x6a8400
cmp edx, 0
je 0x54baad
mov edi, 0x20
mov esi, 0x20
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 8], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], esi
call fcn.0054b830
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, esi
shl esi, 4
add esi, edi
mov ebx, dword [esp + 0x1c]
mov ebp, 0x6d1680
cmp ebx, 8
jae 0x54baa6
shl ebx, 8
add ebp, ebx
mov ebx, esi
mov esi, ebp
cmp ebx, 0x40
jae 0x54ba9f
shl ebx, 2
add esi, ebx
mov dword [esi], edx
mov eax, edi
inc eax
cmp eax, 0x10
jl 0x54b987
inc ecx
cmp ecx, 4
jl 0x54b97c
mov ebx, dword [esp + 0x2c]
inc ebx
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jl 0x54b969
add esp, 0x3c
ret
call fcn.00427bf0
ud2
call fcn.00427bf0
ud2
mov dword [edx], eax
jmp 0x54ba04
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x54b9f4
xor edx, edx
xor eax, eax
jmp 0x54b9e6
call fcn.00427bf0
ud2
call fcn.00427bf0
ud2
call fcn.00427bf0
ud2
call fcn.004501c0
jmp fcn.0054b930
Function at 0x43b664
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ecx
sub esp, 4
mov dword [esp], edi
pop edi
call fcn.0043b69d
add esi, esi
or edi, edi
xor dword [edx], ecx
inc edi
add edx, 1
inc esi
mov esi, 0xbfd9beda
and esi, esi
cmp edx, eax
jne fcn.0043b664
inc esi
ret
Function at 0x412cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x412d3f
cmp byte [esi + 0x3d], bl
je 0x412d3f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x412d6e
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x412d46
sub eax, 1
je 0x412d49
dec eax
sub eax, 1
jne 0x412d6e
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x412d66
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004440a9
add esp, 0x10
cmp edi, eax
jne 0x412d6e
cmp byte [esi + 0x3d], bl
sete al
jmp 0x412d41
xor al, al
jmp 0x412d41

Function at 0x41533f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov eax, edi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [str.SMTP_Server]
movups xmmword [ebx + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x41534c
mov edx, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov esi, dword [ebx + edx*4]
mov eax, edx
cmovae ecx, dword [ebp + 8]
cdq
idiv dword [ebp + 0x20]
movsx eax, byte [edx + ecx]
add eax, esi
add edi, eax
and edi, 0x800000ff
jns 0x41539c
dec edi
or edi, 0xffffff00
inc edi
mov edx, dword [ebp - 4]
mov eax, dword [ebx + edi*4]
mov dword [ebx + edx*4], eax
inc edx
mov dword [ebx + edi*4], esi
mov dword [ebp - 4], edx
cmp edx, 0x100
jl 0x415370
lea ecx, [ebp + 8]
call fcn.00413316
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x4153c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4668fd
call fcn.004662d0
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 0x24]
lea edi, [eax + 0x400]
and dword [ebp - 4], 0
mov ecx, edi
push 0x20
push ebx
call fcn.00412838
xor eax, eax
xor esi, esi
and dword [ebp - 0x10], eax
test ebx, ebx
jle 0x415479
inc eax
and eax, 0x800000ff
jns 0x415409
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
and eax, 0x800000ff
jns 0x415425
dec eax
or eax, 0xffffff00
inc eax
mov ebx, dword [ebp - 0x18]
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + eax*4]
mov dword [ecx + ebx*4], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + eax*4], edx
lea ecx, [ebp + 0xc]
mov eax, dword [ebp - 0x14]
cmovae ecx, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
add eax, edx
and eax, 0x800000ff
jns 0x415458
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x24]
mov dl, byte [edx + eax*4]
mov eax, edi
xor dl, byte [ecx + esi]
cmp dword [edi + 0x14], 0x10
jb 0x41546e
mov eax, dword [edi]
mov byte [eax + esi], dl
inc esi
mov eax, dword [ebp - 0x18]
cmp esi, ebx
jl 0x4153fa
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
call fcn.0041355c
lea ecx, [ebp + 0xc]
call fcn.00413316
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x20

Function at 0x41cb7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41cb8a
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x41cc46
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
sub edi, 1
jne 0x41cb9f
pop edi
test esi, esi
je 0x41cc62
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
inc edx
sub esi, 1
jne 0x41cc4a
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x41cc69
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x477fe0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477fe0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret