joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4998c4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x51a690]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x499904
cmp byte [ebx], 0xa
jne 0x499904
or byte [eax + edi + 0x28], 4
jmp 0x499909
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x499a07
mov al, byte [edx]
cmp al, 0x1a
je 0x4999e9
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x499938
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x49995d
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x499967
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x49991a
jmp 0x499a07
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4999e4
cmp dword [ebp - 0xc], 0
je 0x4999e4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x51a690]
test byte [eax + edi + 0x28], 0x48
je 0x4999be
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4999a9
mov byte [esi], dl
jmp 0x4999ba
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x51a690]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x499a07
cmp byte [ebp - 1], 0xa
jne 0x4999cd
cmp esi, ebx
jne 0x4999cd
mov byte [esi], 0xa
jmp 0x499a06
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040196f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x499a07
mov byte [esi], 0xd
jmp 0x499a06
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x51a690]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x499a03
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x499a07
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x499a63
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x51a690]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x499aa6
cmp word [esi], dx
jne 0x499aa6
or byte [edi + eax + 0x28], 4
jmp 0x499aab
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x499bfe
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x499bde
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x499aed
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x499b23
cmp eax, edx
jae 0x499b2f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x499ac5
jmp 0x499bfe
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x499bda
cmp dword [ebp - 0x14], 0
je 0x499bda
mov eax, dword [ebx*4 + 0x51a690]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x499bb2
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x499b7b
mov word [esi], cx
jmp 0x499bae
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x51a690]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x51a690]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x51a690]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x499bfe
pop ebx
cmp word [ebp - 4], bx
jne 0x499bc3
cmp esi, dword [ebp + 0xc]
jne 0x499bc3
mov word [esi], bx
jmp 0x499bfb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040196f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x499bfe
push 0xd
jmp 0x499bf7
mov ecx, dword [ebx*4 + 0x51a690]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x499bf5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x499bfe
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49eaa1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x516768]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49eaec
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049ef63
test al, al
jne 0x49eae6
sub edx, 2
cmp edx, edi
jne 0x49eacc
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49eb0e
lea eax, [edi + 2]
cmp edx, eax
je 0x49eb0e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049e69a
add esp, 0x10
jmp 0x49ec08
push esi
lea ecx, [ebp - 0x255]
call fcn.0049ef63
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49eb51
push dword [ebp - 0x25c]
jmp 0x49eafe
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49eb8e
cmp word [ebp - 0x226], 0
je 0x49ebaf
cmp word [ebp - 0x226], ax
jne 0x49eb8e
cmp word [ebp - 0x224], 0
je 0x49ebaf
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049e69a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49ebfb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49eb68
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49ebe3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49ec08
push 0x49e082
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004056dc
add esp, 0x10
jmp 0x49ebd8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403107
leave
ret
Function at 0x40bea0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c06b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40bec9
mov eax, 0x7000000
jmp 0x40bed1
test eax, eax
je 0x40c046
mov dword [esp + 0x14], eax
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call fcn.00460ea0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x68d220]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c05e
cmp edx, 0x21
jae 0x40c052
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call fcn.0045ab30
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045ac00
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5c0054]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5c0094]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c021
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5c00d4]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00460f70
mov eax, edx
mov ecx, 0x21
call fcn.00461030
nop
call fcn.0045faf0
jmp fcn.0040bea0
Function at 0x414140
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41434e
sub esp, 0x18
mov eax, dword [0x6c4d90]
test eax, eax
jne 0x414337
nop
nop
lea eax, [0x6c4d80]
mov dword [esp], eax
call fcn.00409b90
mov eax, dword [0x6c4d84]
test eax, eax
je 0x414188
cmp dword [eax + 8], 0xcc
jne 0x4141fe
mov edx, dword [0x6c4d88]
test edx, edx
jne 0x4141e0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x6c9570]
mov dword [esp + 8], eax
call fcn.0040c080
mov eax, dword [esp + 0xc]
mov dword [0x6c4d88], eax
mov ecx, dword [0x6c4d8c]
mov dword [eax], ecx
mov eax, dword [0x6c4d88]
mov dword [0x6c4d8c], eax
movzx eax, byte [0x6c5240]
test al, al
jne 0x4141e0
xor eax, eax
jmp 0x414308
mov edx, dword [0x6c4d88]
mov ebx, dword [edx + 4]
mov dword [0x6c4d88], ebx
mov ebx, dword [0x6c4d84]
mov dword [edx + 4], ebx
mov dword [0x6c4d84], edx
mov edx, dword [0x6c4d84]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4142e7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402b40
mov eax, dword [0x6c4f80]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x414248
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41425e
call fcn.00460f00
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x6c4f80]
test eax, eax
jne 0x414282
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x4142b0
call fcn.00460f40
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x6c4d80]
mov dword [esp], eax
call fcn.00409d90
nop
lea eax, [0x6c4d7c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402cc0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00460f70
lea edx, [0x689644]
movzx ebx, byte [edx + eax]
lea ebp, [0x6c5240]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4141e0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x4142f1
mov ecx, 5
call fcn.00460f60
lea eax, [0x58bcd2]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435bb0
nop
call fcn.0045faf0
jmp fcn.00414140
Function at 0x422060
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422163
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42215d
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004224b0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00422590
movzx eax, byte [esp + 0x18]
test al, 2
je 0x422111
cmp word [esp + 0x10], 0x1f0
jbe 0x422111
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x422115
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x422115
nop
jmp 0x422115
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x422158
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00422520
add esp, 0x1c
ret
call fcn.00460f70
call fcn.00460f70
nop
call fcn.0045faf0
jmp fcn.00422060
Function at 0x422170
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4222a4
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42229e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004224b0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00422680
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x422297
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00422520
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42225a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.0042e910
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x422293
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00402a80
add esp, 0x20
ret
mov eax, edx
call fcn.00460f70
call fcn.00460f70
nop
call fcn.0045faf0
jmp fcn.00422170
Function at 0x427d10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x427e54
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00425b70
mov eax, dword [esp + 4]
test eax, eax
je 0x427e3d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x6c4e70]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.00423790
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call fcn.00409b90
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x427da7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x427dd2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x427dbc
cmp byte [ebp + 6], bl
je 0x427dc7
cmp esi, edx
ja 0x427dce
jne 0x427da5
cmp byte [ebp + 6], bl
jbe 0x427da5
jmp 0x427dce
mov ebx, 1
jmp 0x427dd4
xor ebx, ebx
jmp 0x427dd4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x427df2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call fcn.00427c10
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409d90
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x6c4e70]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x427e2d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x427e2d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x58d8d0]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00435bb0
nop
call fcn.0045faf0
jmp fcn.00427d10
Function at 0x4282e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428450
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x4283e0
cmp cl, 1
je 0x428372
cmp cl, 2
jne 0x428439
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042d920
nop
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409b90
mov eax, dword [0x6a9324]
sub eax, dword [0x6a9308]
nop
mov dword [0x6a9324], eax
mov eax, dword [0x6a9314]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6a9314], ecx
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409d90
jmp 0x428435
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414140
nop
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409b90
mov eax, dword [0x6a92fc]
sub eax, dword [0x6a92e0]
nop
mov dword [0x6a92fc], eax
mov eax, dword [0x6a92ec]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6a92ec], ecx
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409d90
jmp 0x428435
cmp cl, 3
jne 0x4283eb
mov byte [eax + 8], 1
jmp 0x428435
cmp cl, 4
jne 0x428439
nop
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409b90
mov eax, dword [0x6a9374]
sub eax, dword [0x6a9358]
nop
mov dword [0x6a9374], eax
mov eax, dword [0x6a9364]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6a9364], ecx
nop
nop
lea eax, [0x6a9380]
mov dword [esp], eax
call fcn.00409d90
add esp, 0x14
ret
lea eax, [0x588fc2]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435bb0
nop
call fcn.0045faf0
jmp fcn.004282e0
Function at 0x4503d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45054a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x450540
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45042a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45042a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45043d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x450517
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x45050b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x450502
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x450490
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4504d3
mov eax, 1
cmp eax, ecx
ja 0x4504c7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00460fd0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x4504fd
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x4504cc
mov ecx, dword [esp + 0xc]
jmp 0x450495
call fcn.00460f70
xor eax, eax
mov ecx, eax
call fcn.00460f60
call fcn.00460fd0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x45053b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x450510
mov ecx, dword [esp + 0x18]
jmp 0x450442
call fcn.00460f70
xor eax, eax
mov ecx, eax
call fcn.00460f60
nop
call fcn.0045faf0
jmp fcn.004503d0
Function at 0x454540
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454643
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00454c70
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x55e620]
mov dword [esp], ecx
call fcn.0040bd30
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x6a943c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.00453e50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004532a0
add esp, 0x28
ret
call fcn.0045faf0
jmp fcn.00454540

Function at 0x457860
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x6c4e70]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4578fb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x6c4e70]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004610e7
lea ecx, [0x457910]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045fa00
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045faf0
jmp fcn.00457860