joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41593f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x4b900c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
lea eax, [esp + 0x20]
mov edx, 0x4abce8
push eax
push dword [edi + 0x48]
call fcn.0047669a
call eax
test eax, eax
jne 0x41597a
inc eax
jmp 0x415b4a
mov ebx, dword [esp + 0x20]
mov esi, ebx
and esi, 1
mov eax, ebx
mov ecx, esi
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, esi
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, ebx
mov eax, edx
or eax, 0x10
and ecx, 0x10
cmove eax, edx
mov edx, eax
or edx, 0x20
and bl, 0x20
cmove edx, eax
test ecx, ecx
je 0x4159bf
or edx, 0x40000000
jmp 0x4159c5
or edx, 0x80000000
or edx, 0x1000000
mov ebx, edx
or ebx, 0x800000
test esi, esi
push 0
push dword [edi + 0x48]
cmovne ebx, edx
mov edx, 0x4abe28
call fcn.0047669a
call eax
mov dword [edi + 0x3c], eax
mov esi, ebx
cmp eax, 0x28
jbe 0x415ae8
cmp dword [edi + 0x10], 0
jne 0x415ae8
xor esi, esi
mov edx, 0x4abe18
push esi
push esi
push esi
push dword [edi + 0x48]
call fcn.0047669a
call eax
push esi
lea eax, [esp + 0x18]
mov edx, 0x4abe0c
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [edi + 0x48]
call fcn.0047669a
call eax
push esi
push esi
push 0x24
push dword [edi + 0x48]
mov edx, 0x4abe18
call fcn.0047669a
call eax
push esi
lea eax, [esp + 0x18]
mov edx, 0x4abe0c
push eax
push 4
lea eax, [esp + 0x24]
push eax
push dword [edi + 0x48]
call fcn.0047669a
call eax
mov eax, 0x54ad
mov esi, ebx
cmp word [esp + 0x10], ax
jne 0x415ad4
mov ecx, dword [esp + 0x18]
lea eax, [ecx + 0x34]
cmp dword [edi + 0x3c], eax
jbe 0x415ad4
xor esi, esi
mov edx, 0x4abe18
push esi
push esi
push ecx
push dword [edi + 0x48]
call fcn.0047669a
call eax
push esi
lea eax, [esp + 0x18]
mov edx, 0x4abe0c
push eax
push 4
lea eax, [esp + 0x28]
push eax
push dword [edi + 0x48]
call fcn.0047669a
call eax
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x415acc
cmp eax, 0x454e
je 0x415acc
cmp eax, 0x454c
je 0x415acc
mov esi, ebx
cmp eax, 0x4550
jne 0x415ad4
mov esi, ebx
or esi, 0x400000
xor eax, eax
mov edx, 0x4abe18
push eax
push eax
push eax
push dword [edi + 0x48]
call fcn.0047669a
call eax
mov ebx, dword [esp + 0xc]
push dword [esp + 0x30]
push dword [esp + 0x30]
mov dword [ebx + 0x10], esi
call fcn.004158ad
push dword [esp + 0x40]
mov dword [ebx], eax
push dword [esp + 0x40]
call fcn.004158ad
push dword [esp + 0x38]
mov dword [ebx + 4], eax
push dword [esp + 0x38]
call fcn.004158ad
push dword [esp + 0x50]
lea edx, [esp + 0x30]
mov dword [ebx + 8], eax
push dword [esp + 0x50]
lea ecx, [esp + 0x30]
call fcn.0041582a
movzx ecx, word [esp + 0x30]
add esp, 0x20
movzx eax, word [esp + 0x14]
shl ecx, 0x10
or ecx, eax
xor eax, eax
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00476874
mov esp, ebp
pop ebp
ret
Function at 0x416dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 0x1fffc
mov edi, edx
mov byte [esi + 0x6af81], 1
lea ecx, [esi + 0x4af54]
mov dword [esi + 0x6af54], 0x10000
mov dword [esi + 0x6af50], ebx
call fcn.0041c2d4
movzx eax, word [edi*8 + 0x4a6472]
mov dword [esi + 0x6af74], eax
movzx eax, word [edi*8 + 0x4a6470]
pop ecx
mov dword [esi + 0x6af78], eax
movzx eax, word [edi*8 + 0x4a6474]
push 2
mov dword [esi + 0x6af7c], eax
movzx eax, word [edi*8 + 0x4a6476]
pop ecx
mov dword [esi + 0x6af70], eax
cmp edi, ecx
ja 0x416e4c
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x416e57
cmp edi, 8
jb 0x416e57
mov eax, dword [ebp + 8]
or word [eax], cx
mov ecx, dword [esi]
lea edi, [esi + 0x1af54]
push 0x10000
mov edx, edi
call fcn.00417b42
mov dword [esi + 0x6af6c], eax
pop ecx
test eax, eax
je 0x416eb9
mov byte [esi + 0x6af80], bl
mov dword [esi + 0x6af58], ebx
mov dword [esi + 0x6af64], ebx
cmp eax, 0x106
jae 0x416e96
mov ecx, esi
call fcn.0041701c
mov dword [esi + 0x6af5c], ebx
mov ecx, ebx
movzx eax, byte [edi + ebx]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc ebx
mov dword [esi + 0x6af5c], ecx
cmp ebx, 2
jb 0x416e9e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x417776
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x417781
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x41783d
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
sub edi, 1
jne 0x417796
pop edi
test esi, esi
je 0x417859
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
inc edx
sub esi, 1
jne 0x417841
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x417860
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x4a5ff0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a5ff0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x424915
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x424949
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
inc edx
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
cmp edx, edi
jl 0x42492f
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4281dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, dword [edi + 0x88]
test esi, esi
je 0x428211
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 8]
and dword [esi + 0x10], 0
and dword [eax], 0
and dword [eax + 4], 0
jmp 0x428272
movzx eax, word [edi + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.0041e9ee
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x42825b
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x98]
dec ecx
push esi
cdq
push ecx
push edx
push eax
call fcn.00493e80
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [ebp + 8]
push eax
call fcn.0041dead
pop ecx
pop ecx
push 7
pop eax
jmp 0x428283
lea eax, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
mov dword [esi + 0x18], ecx
inc dword [edi + 0x78]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x436950
Capabilities:
Terminate process

Disassembly:
push esi
push edx
push 0x40
pop edx
mov esi, ecx
call fcn.0043670d
mov eax, dword [esi + 0xc]
pop ecx
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
pop esi
and dword [eax + 0x1c], 0
ret

Function at 0x4416e1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420493
Function at 0x445d5a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x4b900c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
push edi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
test esi, esi
je 0x445eaf
push edi
push 0x40
mov ecx, eax
call fcn.0041ea84
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x445eab
push dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [esp + 0x10]
call fcn.00445a65
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx], eax
mov edx, dword [esi + 0x1c]
call fcn.00445b79
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x1c], eax
mov edx, dword [esi + 0x20]
call fcn.00445a47
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x20], eax
mov edx, dword [esi + 0x24]
call fcn.00445a65
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x24], eax
mov edx, dword [esi + 0x28]
call fcn.00445a47
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x28], eax
mov edx, dword [esi + 0x2c]
call fcn.00445a65
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x2c], eax
mov al, byte [esi + 4]
lea esi, [ebx + 0x30]
mov byte [ebx + 4], al
mov eax, dword [esp + 0x20]
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x34], eax
mov dword [esi], edi
mov edx, dword [edx + 0x38]
call fcn.00445a47
pop ecx
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov eax, dword [ecx + 8]
and eax, 0xffffffdf
mov dword [ebx + 8], eax
or dword [ebx + 0x14], 0xffffffff
or dword [ebx + 0x18], 0xffffffff
mov ax, word [ecx + 6]
mov word [ebx + 6], ax
mov edx, dword [ecx + 0x3c]
mov ecx, dword [esp + 0xc]
call fcn.00445999
mov dword [ebx + 0x3c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [eax], ebx
mov eax, dword [esp + 0xc]
mov esi, dword [esi + 0x30]
mov dword [esp + 0x14], esi
test esi, esi
jne 0x445d9e
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00476874
mov esp, ebp
pop ebp
ret

Function at 0x44652c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push 0
push 0x43
pop edx
call fcn.00436721
push edi
push 0x25
pop edx
mov ecx, ebx
call fcn.0043670d
add esp, 0xc
mov ecx, ebx
mov esi, eax
push dword [ebp + 8]
push 0
push edi
push 0x62
pop edx
call fcn.0043669d
add esp, 0xc
mov edx, 0x80
mov ecx, ebx
call fcn.00436c30
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00436c48
Function at 0x447aa6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x4b900c]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], esi
mov ecx, dword [edi + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], esi
test ecx, ecx
jne 0x447aef
xor eax, eax
jmp 0x4485ba
test ebx, ebx
jne 0x447af8
push 0x67
pop edx
jmp 0x447afb
movzx edx, byte [ebx]
lea eax, [edx - 0x13]
mov dword [esp + 0x18], edx
cmp eax, 0x8c
ja 0x44843f
movzx eax, byte [eax + 0x447a4a]
jmp dword [eax*4 + 0x4479d2]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], esi
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], eax
call fcn.0043696d
mov edx, dword [ebx + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
test edx, edx
je 0x4484c5
push 0xc
mov esi, edx
lea edi, [esp + 0x70]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x70]
mov ecx, edi
call fcn.00447a1b
pop ecx
mov edx, eax
lea ecx, [esp + 0x6c]
call fcn.00447a08
push 0x30
xor ebx, ebx
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.00479680
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x78]
mov dword [esp + 0x54], eax
add esp, 0xc
lea eax, [esp + 0x3c]
mov byte [esp + 0x3c], 0x35
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov ebx, dword [ebp + 8]
mov esi, dword [esp + 0x10]
lea ecx, [eax - 1]
test ecx, ecx
jle 0x448563
lea eax, [ecx - 1]
shr eax, 1
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov ecx, edi
call fcn.00447771
mov eax, dword [eax]
test edx, edx
je 0x4484fc
mov dword [esp + 0x4c], eax
jmp 0x448500
mov dword [esp + 0x1c], eax
mov ecx, esi
call fcn.0043696d
push 0x10
mov esi, eax
push esi
push dword [esp + 0x24]
push edi
call fcn.00448db9
mov edx, dword [esp + 0x34]
mov ecx, edi
push ebx
mov edx, dword [edx + 0x18]
call fcn.004487e4
mov edx, dword [esp + 0x3c]
add esp, 0x14
mov ecx, dword [esp + 0x10]
call fcn.00436736
mov ecx, edi
call fcn.00447775
mov edx, esi
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.004369af
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
add eax, 0x30
sub dword [esp + 0x20], 1
mov dword [esp + 0x24], eax
jne 0x4484e9
mov eax, dword [esp + 0x18]
test al, 1
je 0x448589
mov ecx, edi
call fcn.00447771
imul edx, eax, 0x18
mov eax, dword [esp + 0x38]
push ebx
mov edx, dword [edx + eax - 0x14]
call fcn.004487e4
pop ecx
mov ecx, edi
call fcn.00447775
jmp 0x448598
push ebx
push 0
push 0x46
pop edx
mov ecx, esi
call fcn.00436721
pop ecx
pop ecx
mov edx, dword [esp + 0x28]
mov ecx, esi
call fcn.004369af
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00449990
mov edx, dword [esp + 0x30]
call fcn.00449990
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00476874
mov esp, ebp
pop ebp
ret
Function at 0x44b720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4b900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x24], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
cmp dword [esi + 0x24], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
push edi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], eax
jne 0x44b858
mov edx, dword [ebp - 0x24]
lea edi, [ebp - 0x20]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], esi
call fcn.0044b27a
test eax, eax
jne 0x44b858
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.0044b27a
test eax, eax
jne 0x44b858
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
call fcn.0044b27a
test eax, eax
jne 0x44b858
test ebx, ebx
je 0x44b7d2
cmp byte [ebx], 0x63
jne 0x44b7b6
mov eax, dword [ebx + 8]
jmp 0x44b7b8
xor eax, eax
mov edx, dword [ebp - 0x30]
mov ecx, esi
push 0
push 0
push eax
call fcn.0044bd79
add esp, 0xc
test eax, eax
jne 0x44b858
mov ecx, esi
call fcn.0045cd1f
push 4
pop edx
mov ecx, esi
mov ebx, eax
call fcn.004499d3
mov edx, dword [ebp - 0x24]
mov edi, eax
push edi
mov ecx, esi
call fcn.004487e4
pop ecx
lea edx, [edi + 1]
mov ecx, esi
push edx
mov edx, dword [ebp - 0x28]
call fcn.004487e4
mov edx, dword [ebp - 0x2c]
lea eax, [edi + 2]
pop ecx
push eax
mov ecx, esi
call fcn.004487e4
pop ecx
test ebx, ebx
je 0x44b858
mov esi, dword [ebp - 0x34]
lea eax, [edi + 3]
push 0xfffffffffffffff8
push esi
push eax
movsx eax, byte [esi]
mov edx, 0xa4
sub edi, eax
mov ecx, ebx
add edi, 3
push edi
push 0
call fcn.004367ed
movzx edx, byte [esi]
add esp, 0x14
mov ecx, ebx
call fcn.00436c30
xor eax, eax
mov edx, 0x99
cmp dword [ebp - 0x30], 0x18
sete al
push eax
call fcn.0043670d
pop ecx
mov ebx, dword [ebp - 0x38]
mov ecx, ebx
mov edx, dword [ebp - 0x24]
call fcn.004456e4
mov edx, dword [ebp - 0x28]
mov ecx, ebx
call fcn.004456e4
mov edx, dword [ebp - 0x2c]
mov ecx, ebx
call fcn.004456e4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476874
mov esp, ebp
pop ebp
ret
Function at 0x45cd3f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4b900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
cmp dword [edi + 0xc], 0
mov esi, dword [edi + 0x38]
mov dword [ebp - 0x14], esi
jne 0x45ce51
call fcn.00447990
test esi, esi
je 0x45ce51
inc dword [ebx + 0x2c]
mov ecx, ebx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x10], eax
mov dword [edi + 0xc], eax
call fcn.0045cd1f
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.00446354
push dword [ebp - 0x10]
test eax, eax
je 0x45cdde
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push 0x43
pop edx
call fcn.00436721
mov eax, dword [ebp - 8]
pop ecx
pop ecx
test eax, eax
jne 0x45cdbf
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
call fcn.00436736
jmp 0x45ce0b
js 0x45ce0b
cdq
push edx
push eax
call fcn.00421cd5
pop ecx
pop ecx
cmp word [edi + 6], ax
jle 0x45ce0b
or dword [edi + 8], 0x4000
mov word [edi + 6], ax
jmp 0x45ce0b
mov edx, dword [esi + 0xc]
mov ecx, ebx
call fcn.004487e4
pop ecx
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push 0x11
pop edx
call fcn.0043670d
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x16
pop edx
call fcn.00436721
pop ecx
pop ecx
cmp dword [esi + 0x10], 0
je 0x45ce51
inc dword [ebx + 0x2c]
mov ecx, ebx
mov esi, dword [ebx + 0x2c]
mov edx, dword [ebp - 0x14]
mov dword [edi + 0x10], esi
inc dword [ebx + 0x2c]
push esi
mov edx, dword [edx + 0x10]
call fcn.004487e4
pop ecx
mov ecx, dword [ebp - 0xc]
push esi
push 0x11
pop edx
call fcn.0043670d
pop ecx
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 1]
push esi
push eax
push dword [ebp - 0x10]
mov edx, 0x95
call fcn.0043669d
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476874
mov esp, ebp
pop ebp
ret
Function at 0x4621fe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0xc], 0
mov edi, ecx
jne 0x462260
and dword [ebp - 8], 0
lea eax, [ebp - 8]
mov edx, esi
shl edx, 4
add edx, dword [ebx + 4]
push eax
movzx eax, byte [edx + 0xd]
push eax
call fcn.00424e2f
movzx eax, byte [eax + 0x46]
push eax
call fcn.00424e2f
mov edx, dword [edx + 4]
mov ecx, eax
call fcn.004363fe
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
je 0x462260
push 0xfffffffffffffff5
mov ecx, edi
call fcn.00436eca
pop ecx
mov eax, dword [ebx + 4]
add esi, esi
cmp byte [eax + esi*8 + 0xd], 0x45
jne 0x46227a
push dword [ebp + 0xc]
mov ecx, edi
push 0x51
pop edx
call fcn.0043670d
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476874
mov esp, ebp
pop ebp
ret
Function at 0x474c11
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], edx
push edi
mov dword [ebp - 0xc], ecx
mov eax, esi
mov byte [ebp + eax - 0x10c], al
inc eax
cmp eax, 0x100
jb 0x474c27
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x10c]
mov eax, edi
div dword [ebp - 8]
movzx eax, byte [edx + ecx]
add eax, esi
movzx ecx, bl
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
inc edi
mov byte [ebp + esi - 0x10c], bl
cmp edi, 0x100
jb 0x474c38
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, esi
test edi, edi
je 0x474cd5
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [ebx + 1]
movzx ebx, al
mov dl, byte [ebp + ebx - 0x10c]
movzx eax, dl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + ebx - 0x10c], al
mov byte [ebp + esi - 0x10c], dl
movzx ecx, byte [ebp + ebx - 0x10c]
movzx eax, dl
add ecx, eax
mov eax, dword [ebp + 0xc]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x10c]
xor byte [eax], cl
inc eax
mov dword [ebp + 0xc], eax
sub edi, 1
jne 0x474c86
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474e0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, edx
cmp dword [ebp + 0xc], esi
jbe 0x474e33
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov eax, esi
div ebx
mov al, byte [edx + ecx]
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x474e20
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x475368
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edx, 0x811c9dc5
call fcn.004752db
mov edi, eax
xor esi, esi
test edi, edi
je 0x47538d
movsx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x47537c
pop edi
mov eax, edx
pop esi
ret
Function at 0x47658e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x4765bf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x4c01f8]
mov eax, 0x5a4d
mov dword [ebp - 4], edx
cmp word [esi], ax
je 0x4765de
xor eax, eax
jmp 0x47663f
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4765da
mov ecx, 0x2000
push edi
test word [eax + 0x16], cx
je 0x47663c
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x47663c
xor edi, edi
cmp dword [eax + 0x7c], edi
je 0x47663c
mov ebx, dword [ecx + esi + 0x1c]
mov edx, dword [ecx + esi + 0x20]
add edx, esi
mov dword [ebp - 8], edx
lea eax, [ebx + esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + esi + 0x24]
add eax, esi
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x47663c
mov ecx, dword [edx + edi*4]
add ecx, esi
call fcn.004765a2
cmp eax, dword [ebp - 4]
je 0x476645
mov edx, dword [ebp - 8]
inc edi
cmp edi, ebx
jb 0x476625
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x47663e

Function at 0x485d1a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00485b99