joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb edi, 0x24
ror ebx, 2
bswap edx
ror edi, 0x6b
rcr esi, 0x7d
neg esi
dec edi
not eax
bswap eax
inc esi
dec esi
neg edi
bswap esi
or eax, 0x15
not ebx
mov esi, 0x9f
or eax, 0xc0
and esi, 0x40
and eax, 0xd0
imul edx
not ebx
not edi
dec esi
ror edi, 0xa3
rcl eax, 0xde
add esi, 0x1d
inc edx
add eax, 0x80
rcr edi, 0x65
neg edi
ror edi, 0x86
not edi
ror edx, 0x85
neg edi
imul edi
bswap eax
ror eax, 0xac
imul ebx
bswap ebx
and ebx, 0xe2
not edx
rol ebx, 0xcb
inc edx
inc esi
or esi, 0xdc
not edi
add edi, 0x5d
not esi
bswap eax
imul eax
xor ecx, ecx
xor edi, edi
inc ebx
sub esi, 0x88
bswap edx
and edx, 0x7b
imul esi
imul eax
or eax, 0xd0
inc ebx
sub ebx, 0xa9
and esi, 0x60
ror ebx, 0xbc
neg edi
mov ebx, 0x47
imul eax
inc esi
sub edi, 0xfc
not ebx
or edi, 0x9d
sbb edx, 0x2b
bswap edi
or ebx, 0xdd
sbb edx, 0x25
inc edi
imul edx
mov edi, 0xfb
bswap esi
mov ebx, 0xc4
rcr esi, 0xf2
imul esi
inc edx
neg edi
bswap ebx
dec eax
bswap eax
ror esi, 0xdc
or edi, 0x1a
bswap ebx
inc eax
not esi
mov edi, 0x45
rcr esi, 0x30
and ebx, 0xc8
dec ebx
sub eax, 0x42
rol esi, 0x10
imul edx
bswap eax
sbb esi, 0x5b
sbb edi, 0x9a
rcr esi, 0x82
mov ecx, dword [ebp + 0xc]
sbb edx, 0xcc
dec eax
neg esi
or ebx, 0x48
sub esi, 0xc5
bswap edi
mov eax, 0xd4
dec edi
not ebx
and edx, 0x6d
dec ebx
sub edx, 0xdc
rol edx, 0x40
rcr edx, 0x81
imul ebx
neg edx
or eax, 0x80
imul ebx
rcr edi, 0x89
bswap edx
rol edi, 0xbc
bswap eax
rcl esi, 0xcc
or edx, 0xe3
and edi, 0x94
sbb eax, 0x48
or eax, 0xca
not edi
imul ebx
dec edx
sbb edi, 0xe4
rcr edx, 0x3a
mov edx, 0x2b
mov edx, 0xb1
imul ebx
not edi
ror esi, 0xa5
rcl edx, 0xbd
imul edi
sbb edi, 0x6b
imul ebx
mov esi, 0x36
imul edi
dec ebx
not esi
imul edx
bswap eax
and edx, 0xaf
dec ebx
imul edi
mov edi, dword [ebp + 8]
xor eax, ebx
mov eax, eax
mov ebx, esi
not byte [edi]
mov eax, ebx
xor ebx, esi
mov esi, ebx
mov eax, ebx
xor eax, esi
xor ebx, esi
mov ebx, eax
xor eax, ebx
mov eax, esi
add byte [edi], 0x54
mov ebx, ebx
mov esi, eax
mov esi, esi
mov ebx, ebx
mov eax, eax
xor eax, ebx
mov eax, eax
xor esi, ebx
xor eax, esi
sub byte [edi], 0x29
xor eax, esi
xor esi, esi
xor ebx, esi
mov eax, eax
xor esi, esi
mov esi, esi
xor eax, esi
xor esi, eax
mov eax, ebx
imul byte [edi]
inc edi
loop 0x402de2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40b2ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47ac90]
jne 0x40b2c4
repz ret
jmp fcn.0041284e
Function at 0x4171cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411156
and dword [ebp - 4], 0
cmp dword [0x47c7d0], 0
mov ebx, eax
jne 0x41727d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41732e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41732e
push eax
call fcn.004110e4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47c7d0], eax
call esi
push eax
call fcn.004110e4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47c7d4], eax
call esi
push eax
call fcn.004110e4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47c7d8], eax
call esi
push eax
call fcn.004110e4
pop ecx
mov dword [0x47c7e0], eax
test eax, eax
je 0x41727d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004110e4
pop ecx
mov dword [0x47c7dc], eax
mov eax, dword [0x47c7dc]
cmp eax, ebx
je 0x4172d5
cmp dword [0x47c7e0], ebx
je 0x4172d5
push eax
call fcn.0041115f
push dword [0x47c7e0]
mov esi, eax
call fcn.0041115f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4172d5
test edi, edi
je 0x4172d5
call esi
test eax, eax
je 0x4172cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4172cc
test byte [ebp - 0xc], 1
jne 0x4172d5
or dword [ebp + 0x10], 0x200000
jmp 0x41730e
mov eax, dword [0x47c7d4]
cmp eax, ebx
je 0x41730e
push eax
call fcn.0041115f
pop ecx
test eax, eax
je 0x41730e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41730e
mov eax, dword [0x47c7d8]
cmp eax, ebx
je 0x41730e
push eax
call fcn.0041115f
pop ecx
test eax, eax
je 0x41730e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47c7d0]
call fcn.0041115f
pop ecx
test eax, eax
je 0x41732e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417330
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x43b636
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
push edx
pop edx
call fcn.0043b669
or ecx, edx
sub ecx, edx
and edx, ecx
xor dword [eax], ebx
add edx, 1
sub ecx, 0x17b5df63
sub ecx, ecx
inc eax
dec edx
cmp eax, esi
jne fcn.0043b636
and edx, edx
sub edx, 0x654bfcee
ret
Function at 0x409b3a
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x409b3c
ret

Function at 0x40b750
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
or eax, 0x448bff33
and al, 0x80
or eax, eax
jge 0x40b770
inc edi
sahf
push esp
push ds
or al, 0xf7
fdiv st(7)
fiadd dword [ebx + 0x448974d8]
and al, 0x10
mov dword [esp + 0x14], edx
mov eax, dword [edi + ebp*2 + 0x18]
or eax, eax
jge 0x40b7bb
mov esi, dword [ecx + 0x24]
adc al, 0xcf
fdiv st(7)
fiadd dword [ebx + 0x448900d8]
and al, 0xf2
mov dword [ecx + ebx*4 + 0x14], edx
or eax, dword [eax + 0x4c231b75]
rcl dword [ebx + ecx*4], cl
add dword [eax + edx], esp
xor edx, edx
div ecx
mov eax, dword [esp + ebx*4 + 0xc]
div ecx
mov eax, edx
xor ecx, dword [ebp - 0x14b186b1]
push ebx
sbb al, 0x8b
dec esp
and al, 0x14
mov ah, 0x54
and al, 0x10
mov eax, dword [esp - 0x2c]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
xor ah, dh
test cl, dh
inc ebp
enter 0x64f7, 0x24
sbb byte [ecx + 0x722464a9], dl
add edx, ecx
jb 0x40b7e3
invalid
sal dword [edx + 0xe], 1
cmp edx, dword [esi + edi*4 + 0x10]
salc
or byte [edx + 0xe], dh
cmp eax, dword [esp + 0xc]
add ecx, ebx
inc esp
and al, 0xff
sbb edi, dword [edx + 0x24]
sbb byte [ebx], ch
and dl, al
or al, 0xfb
xchg esp, eax
and al, 0x10
dec edi
out 0x2f, eax
jecxz 0x40b7d2
retf
neg eax
sbb edx, 0x34
pop edi
pop ebx
ret 0x42
Function at 0x407ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407c4b
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x407c3e
mov ebp, dword [eax]
cmp ebp, 0
je 0x407c3e
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x407b19
mov ebx, 0x487ee6
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.00424fa0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x407b9c
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x407b4a
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x407b70
inc eax
cmp eax, 8
jb 0x407b2e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x407b27
mov ebx, 0x4d1880
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x407b44
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x407c3a
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x407b27
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x407c36
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x407c36
mov eax, 1
cmp al, 0
jne 0x407b27
mov ecx, edx
jmp 0x407b27
xor eax, eax
jmp 0x407c26
xor ebx, ebx
jmp 0x407bd3
mov ebx, 0x4d1880
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.00448770
jmp fcn.00407ac0
Function at 0x407c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407dfe
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x407dec
mov ebp, dword [eax]
cmp ebp, 0
je 0x407dec
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x407cb9
mov ebx, 0x487ee6
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.00424fa0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x407d4a
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x407cee
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x407d19
inc eax
cmp eax, 8
jb 0x407cd2
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x407ccb
mov ebx, 0x4d1880
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x407ce8
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x407de8
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x407ccb
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x407de4
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x407de4
mov eax, 1
cmp al, 0
jne 0x407ccb
mov ecx, edx
jmp 0x407ccb
xor eax, eax
jmp 0x407dd4
xor ebx, ebx
jmp 0x407d81
mov ebx, 0x4d1880
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.00448770
jmp fcn.00407c60
Function at 0x41e2c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41e4d3
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x41e3b7
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call fcn.00410610
mov ebx, 0x4c2de0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.00409a60
mov eax, 0x4c2de0
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x41e3b3
cmp byte [0x4d1078], 0
jne 0x41e39d
mov dword [edx], ebp
cmp eax, 0
je 0x41e399
cmp byte [0x4d1078], 0
jne 0x41e388
mov dword [eax + 0xc], edx
mov ebx, 0x4c2de0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.00409ca0
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040c2a0
jmp 0x41e370
mov dword [eax], eax
jmp 0x41e364
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040c2a0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x41e35f
mov dword [edx], eax
jmp 0x41e354
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x41e479
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.0041f210
mov ebx, 0x4c2de0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.00409a60
mov eax, 0x4c2de0
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x41e475
cmp byte [0x4d1078], 0
jne 0x41e45f
mov dword [edx], ebp
cmp eax, 0
je 0x41e45b
cmp byte [0x4d1078], 0
jne 0x41e44a
mov dword [eax + 0xc], edx
mov ebx, 0x4c2de0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.00409ca0
jmp 0x41e384
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040c2a0
jmp 0x41e431
mov dword [eax], eax
jmp 0x41e425
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040c2a0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x41e420
mov dword [edx], eax
jmp 0x41e415
mov ebx, 0x48549b
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.00424fa0
mov ebx, 0x4849c9
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x474a60
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.00408fa0
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call fcn.00424910
ud2
call fcn.00448770
jmp fcn.0041e2c0
Function at 0x41f7c0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f921
sub esp, 0x28
mov ebx, 0x4d1020
mov dword [esp], ebx
call fcn.00409a60
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call fcn.00425780
mov ebx, 0x484770
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.00426190
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.00426150
mov ebx, 0x483fc7
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.00426190
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00426020
mov ebx, 0x483fc5
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.00426190
call fcn.00425800
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.0043fff0
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.0044a010
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.0044a040
mov edx, dword [esp + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
mov ecx, 0x444c60
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.00448660
call fcn.00425780
mov ebx, 0x483fb3
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.00426190
call fcn.00425800
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, 0x4d1020
mov dword [esp], ebx
call fcn.00409ca0
add esp, 0x28
ret
call fcn.00448770
jmp fcn.0041f7c0
Function at 0x41ffb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42013c
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x420131
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x420024
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x42000f
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x420128
cmp ecx, 0x20
jae 0x42011d
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call fcn.00442ea0
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x4200aa
jbe 0x4200a3
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x420031
cmp edx, 0
jb 0x4200aa
jmp 0x42009c
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x420117
cmp ecx, 0x20
jae 0x42010f
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00442ea0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x4200c5
xor edx, edx
xor eax, eax
jmp 0x4200bb
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x42005a
xor edx, edx
xor eax, eax
jmp 0x42004c
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x420005
call fcn.00448770
jmp fcn.0041ffb0
Function at 0x42c190
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x70]
inc edx
mov dword [ecx + 0x70], edx
mov ecx, 1
mov byte [eax + 0x85], cl
mov ecx, 0xfffffade
mov dword [eax + 8], ecx
mov ebp, dword [eax + 0x18]
mov ebx, dword [ebp + 0x54]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [eax + 0x18]
mov dword [ebp + 0x204], ecx
mov ecx, 1
mov byte [eax + 0x87], cl
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 0x18]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0x14]
inc ecx
mov dword [eax + 0x14], ecx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.0044a010
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.0044a040
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], esi
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x20], esi
xor edx, edx
mov dword [ecx + 0x34], edx
xor edx, edx
mov dword [ecx + 0x30], edx
xor edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], ecx
mov ebp, dword [eax + 0x20]
mov dword [eax + 0x3c], ebp
mov ebp, dword [eax + 0x24]
mov dword [eax + 0x40], ebp
mov edx, dword [eax + 0x3c]
mov ebp, dword [eax]
cmp edx, ebp
jb 0x42c332
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x3c]
cmp edx, ebp
jb 0x42c332
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.004283d0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x3c]
mov ebp, dword [ecx]
cmp eax, ebp
jb 0x42c302
mov eax, dword [ecx + 4]
mov ebp, dword [ecx + 0x3c]
cmp eax, ebp
jb 0x42c302
mov ebx, 0x48e3fc
mov dword [esp], ebx
call fcn.00448660
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.0044a010
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.0044a040
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
dec ecx
mov dword [eax + 0x70], ecx
add esp, 0x3c
ret
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov edx, 0x4452a0
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp], eax
call fcn.00448660
jmp 0x42c296
mov edi, esi
mov esi, dword [eax + 0x20]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x445130
mov ebp, dword [esp + 0x14]
mov dword [ecx], ebp
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], eax
mov dword [esp], ecx
call fcn.00448660
mov eax, dword [esp + 0x18]
jmp 0x42c267