joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4534f0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xac]
mov byte [esi + 0xb0], 0
test ecx, ecx
je 0x453513
call fcn.004534f0
mov dword [esi + 0xac], 0
push 0
push dword [esi + 0xb8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45356d
push edi
nop dword [eax]
mov eax, dword [esi + 0xc0]
mov edi, dword [eax + ecx*4 - 4]
test edi, edi
je 0x453553
mov ecx, edi
call fcn.0044ede0
push 0xac
push edi
call fcn.004ff57b
add esp, 8
mov ecx, dword [esi + 0xbc]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x45356c
mov ecx, eax
mov dword [esi + 0xbc], eax
test ecx, ecx
jg 0x453530
pop edi
cmp dword [0x912518], esi
jne 0x45357f
mov dword [0x912518], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
pop esi
ret
Function at 0x4569f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
push edi
push 0xe
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x456b88
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456b88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [ebp - 0x8c], ecx
test ecx, ecx
je 0x456b88
movaps xmm0, xmmword [0x5a51f0]
lea edx, [ecx + 6]
push ebx
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x88], edx
movups xmmword [ebp - 0x9c], xmm0
test ebx, ebx
js 0x456a9f
movzx edi, word [ecx + 4]
xor eax, eax
test edi, edi
je 0x456a9a
add edx, 6
movzx ecx, word [edx]
cmp ecx, dword [ebp + ebx*4 - 0x9c]
jne 0x456a86
mov dword [ebp + esi*4 - 0x84], eax
inc esi
inc eax
add edx, 0xe
cmp eax, edi
jl 0x456a72
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
dec ebx
test esi, esi
je 0x456a61
test esi, esi
jle 0x456b19
xor ebx, ebx
mov edi, edx
mov edx, dword [ebp + 0x10]
xor ecx, ecx
movzx eax, byte [edi]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp + ecx*4 - 0x44], eax
je 0x456acf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x456acf
inc ecx
add edi, 0xe
cmp ecx, esi
jl 0x456ab0
cmp ecx, esi
jne 0x456afc
xor edx, edx
xor edi, edi
nop word [eax + eax]
lea ecx, [edx*4]
mov eax, dword [ebp + ecx - 0x44]
cmp eax, dword [ebp + edi - 0x44]
jge 0x456af5
mov ebx, edx
mov edi, ecx
inc edx
mov ecx, ebx
cmp edx, esi
jl 0x456ae0
mov eax, dword [ebp + ecx*4 - 0x84]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebp - 0x88]
movzx eax, word [eax + ecx*2 + 0xc]
jmp 0x456b29
mov eax, dword [ebp + 0x10]
push 0
push eax
push eax
push 1
push ecx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
push 3
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
pop ebx
test esi, esi
je 0x456b88
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456b88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456b88
push 0
push 0
push 0
push 0x30000
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004ff23c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457620
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45764e
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call fcn.0050489e
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x45767f
push edi
lea esi, [eax + 3]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x457765
cmp esi, dword [ebp - 4]
jne 0x457765
push ebx
mov byte [esi + ebx], 0
call fcn.0043a9f0
push str._License_
push ebx
call fcn.00500b90
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4576c7
mov esi, 4
jmp 0x45776a
cmp byte [esi + 9], 0x3d
jne 0x4576bd
push 0x104
push str.DeskSoft_License
push str._Product_
push ebx
mov byte [esi + 9], 0
call fcn.0043b590
add esp, 0x10
test al, al
je 0x4576bd
push 0x104
push 0x913820
push str._Version_
push ebx
call fcn.0043b590
add esp, 0x10
test al, al
je 0x4576bd
push 0x104
push 0x913928
push str._ExpDate_
push ebx
call fcn.0043b590
add esp, 0x10
test al, al
je 0x4576bd
lea eax, [esi + 0xa]
push eax
push ebx
call fcn.0043be90
neg eax
push str.DesktopPlant
sbb esi, esi
push str.DeskSoft_License
and esi, 2
call fcn.00500b90
add esp, 0x10
test eax, eax
je 0x45776a
push str.DesktopPlant
push 0x104
push str.DeskSoft_License
call fcn.005048a9
add esp, 0xc
jmp 0x45776a
mov esi, 3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00504903
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x472a10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.004ffc70
mov eax, dword [0x62bcc0]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x472a76
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.0052b3f0
add esp, 0xc
cmp edi, 0x40
jbe 0x472a92
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.0052b3f0
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x472ab9
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.00501660
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x472baf
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x24], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x24]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x28]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x472b30
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x472bea
mov ebp, dword [esp + 0x30]
nop dword [eax]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x472bc0
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ff23c
add esp, 0xa8
ret
Function at 0x473660
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004ffc70
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x4736aa
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x47369d
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x4736af
cmp ebp, dword [esi + 4]
ja 0x473694
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x473702
cmp dword [edi + 0x88], 0
jne 0x473702
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x5ab0c0
push eax
call fcn.0052b080
add esp, 0xc
test eax, eax
jne 0x4736f5
test bl, 1
jne 0x4736f5
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x473702
test ebx, ebx
je 0x473702
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call fcn.00458eb0
add esp, 4
test eax, 0x200000
je 0x47372e
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
lea ecx, [ebx + ebp]
mov ebp, dword [esi + 4]
mov edx, ebp
mov dword [esp + 0x14], ebp
sub edx, ecx
mov eax, ebp
xor edx, ecx
xor eax, ecx
or edx, eax
mov ecx, 0xff
xor edx, ebp
lea eax, [ebp - 1]
shr edx, 0x1f
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
xor edi, edi
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4737b9
mov ecx, ebx
dec ebp
shr ecx, 0x1f
add ebp, dword [esi + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov al, byte [esp + 0x28]
lea ebp, [ebp - 1]
mov edx, ebx
mov ecx, edi
sub edx, edi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc edi
or dl, al
movzx eax, byte [ebp + 1]
xor dl, byte [esp + 0x28]
xor eax, ebx
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
and ecx, eax
not ecx
and edx, ecx
mov dword [esp + 0x1c], edx
cmp edi, esi
jb 0x473776
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edx
movzx eax, dl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebx + 1]
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
pop ebx
pop edi
mov dword [esi + 4], ebp
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
add esp, 8
ret
Function at 0x473bd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.004ffc70
push ebx
push esi
push edi
lea eax, [esp + 0x14]
xor esi, esi
push eax
lea eax, [esp + 0x10]
xor edi, edi
push eax
push esi
call fcn.00463de0
add esp, 0xc
test eax, eax
je 0x473ddb
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
shl eax, 0xa
test ebx, eax
je 0x473c0c
inc edi
lea eax, [esp + 0x14]
inc esi
push eax
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00463de0
add esp, 0xc
test eax, eax
jne 0x473c00
test edi, edi
je 0x473ddb
mov ecx, dword [esp + 0x50]
mov eax, ecx
cdq
idiv edi
push ebp
mov ebp, dword [esp + 0x58]
mov esi, eax
xor eax, eax
mov dword [esp + 0x14], esi
cmp edi, 1
mov edi, dword [esp + 0x60]
push edi
push eax
cmove ecx, eax
push ebp
mov dword [esp + 0x60], ecx
call fcn.00501660
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00463de0
add esp, 0x18
test eax, eax
je 0x473da6
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x24], eax
je 0x473d82
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x473db3
push edi
push ebx
push dword [esp + 0x54]
mov eax, dword [esp + 0x60]
push dword [esp + 0x54]
and eax, 1
push dword [esp + 0x54]
add eax, esi
mov esi, dword [esp + 0x64]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
push esi
push ecx
call fcn.00473e00
add esp, 0x3c
test eax, eax
je 0x473dd1
add esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x50], esi
test edi, edi
jle 0x473d7e
cmp edi, 0x20
jb 0x473d5b
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x473d10
cmp edx, ebx
jae 0x473d5b
mov eax, edi
and eax, 0x8000001f
jns 0x473d1e
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x473d30
cmp ecx, edi
jge 0x473d7e
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
nop word [eax + eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x473d70
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.00463de0
add esp, 0xc
test eax, eax
jne 0x473c80
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.0052e7d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.0052e7d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x485e60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [eax + 4], 0
je 0x485ebf
push edi
mov edi, dword [eax + 0x28]
test edi, edi
je 0x485ebe
push ebx
call fcn.00485a60
xor ebx, ebx
test edi, edi
je 0x485ebd
push esi
lea esi, [eax + 1]
nop word [eax + eax]
lea ecx, [edi - 1]
xor edx, edx
mov eax, 0xff
lea esi, [esi + 4]
div ecx
movzx ecx, bl
inc ebx
movzx eax, al
imul eax, ecx
mov byte [esi - 3], al
mov byte [esi - 4], al
mov byte [esi - 5], al
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x28]
cmp ebx, edi
jb 0x485e90
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x487b10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x487b1e
pop ebp
ret 0xc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00516373
add esp, 0x10
pop ebp
ret 0xc
Function at 0x4915d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, 1
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 0x420], eax
mov eax, 1
shl ax, cl
mov dword [edi + 0x41c], ecx
dec ax
mov dword [edi + 0x410], ecx
dec ecx
shl edx, cl
mov ecx, edi
mov word [edi + 0x414], ax
mov dword [edi + 0x418], 0
mov dword [edi + 0x3bc], 0
lea eax, [edx + 1]
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x428], eax
lea eax, [edx + 2]
mov dword [edi + 0x424], edx
mov word [edi + 0x416], ax
mov dword [edi + 0x42c], 0
call fcn.00491440
mov esi, eax
xor edx, edx
mov dword [ebp + 8], esi
mov ecx, 0x138b
nop dword [eax]
add ecx, ecx
inc edx
cmp ecx, 0x10000
jl 0x491660
mov eax, 8
mov ecx, edi
sub eax, edx
push 0x138b
mov dword [ebp - 4], eax
call fcn.00491510
movzx eax, word [edi + 0x424]
mov ecx, edi
push eax
call fcn.00492570
mov ecx, edi
call fcn.00491440
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x491791
push ebx
mov ecx, dword [ebp - 4]
mov ebx, eax
mov edx, dword [ebp + 8]
shl ebx, 0xc
add ebx, esi
movsx esi, ax
mov eax, dword [edi + 0x408]
shl esi, cl
xor esi, edx
mov eax, dword [eax + esi*4]
cmp eax, ebx
jne 0x4916d7
mov eax, dword [edi + 0x40c]
movzx esi, word [eax + esi*2]
mov dword [ebp + 8], esi
jmp 0x49177d
test eax, eax
js 0x49170e
mov ecx, 0x138b
mov eax, 1
sub ecx, esi
test esi, esi
cmove ecx, eax
nop dword [eax]
mov eax, esi
sub eax, ecx
lea esi, [eax + 0x138b]
cmovns esi, eax
mov eax, dword [edi + 0x408]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x4916c5
test eax, eax
jg 0x4916f0
push edx
mov ecx, edi
call fcn.00492570
movzx ecx, word [edi + 0x416]
mov eax, 0x1000
mov edx, dword [ebp + 0xc]
mov dword [ebp + 8], edx
cmp cx, ax
jge 0x49174b
mov eax, dword [edi + 0x40c]
mov word [eax + esi*2], cx
mov eax, dword [edi + 0x408]
inc word [edi + 0x416]
mov dword [eax + esi*4], ebx
mov esi, edx
jmp 0x49177d
push 0x138b
mov ecx, edi
call fcn.00491510
movzx ecx, word [edi + 0x424]
push ecx
mov dword [edi + 0x418], 1
lea eax, [ecx + 2]
mov ecx, edi
mov word [edi + 0x416], ax
call fcn.00492570
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.00491440
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x4916a4
pop ebx
push esi
mov ecx, edi
call fcn.00492570
movzx eax, word [edi + 0x428]
mov ecx, edi
push eax
call fcn.00492570
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x49e6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x49e6f8
cmp dword [ebp + 0xc], 0xf0
jae 0x49e6e8
push eax
call fcn.004a4320
push 2
call fcn.004a4270
add esp, 8
mov dword [esi], eax
push 0xf0
push 0
push eax
call fcn.00501660
add esp, 0xc
pop esi
pop ebp
ret
Function at 0x4a2060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [eax + 8]
mov byte [ebp - 0x15], cl
cmp cl, 3
je 0x4a2249
push ebx
mov ebx, dword [eax]
xor edx, edx
push edi
movzx edi, byte [eax + 9]
test cl, 2
mov eax, dword [ebp + 0x10]
mov ecx, edi
je 0x4a20c3
movzx eax, byte [eax]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, edi
movzx eax, byte [eax + 1]
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, edi
movzx eax, byte [eax + 2]
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [edx + 3]
jmp 0x4a20d1
movzx eax, byte [eax + 3]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x4a20eb
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 4]
sub edi, eax
mov dword [ebp + ecx*4 - 0x14], edi
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je case.0x4a2133.3
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x4a2106
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x4a210b
mov edx, 1
inc eax
cmp eax, ecx
jl 0x4a20f5
test dx, dx
je case.0x4a2133.3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4a2133.3
movzx eax, byte [eax + 0x4a226c]
jmp dword [eax*4 + 0x4a2258]
mov ecx, dword [edx + 4]
test ecx, ecx
je case.0x4a2133.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, 1
and al, 0x55
mov byte [esi - 1], al
sub ecx, 1
jne 0x4a2145
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov ebx, 0xf0
mov edx, dword [edx + 4]
mov eax, 0xf
sar ebx, cl
and bl, 0xf0
sar eax, cl
or bl, al
test edx, edx
je case.0x4a2133.3
mov al, byte [esi]
lea esi, [esi + 1]
shr al, cl
mov ecx, dword [ebp - 0x14]
and al, bl
mov byte [esi - 1], al
sub edx, 1
jne 0x4a2188
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x4a2133.3
nop word [eax + eax]
mov eax, edi
lea esi, [esi + 1]
xor edx, edx
inc edi
div ecx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x4a21c0
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je case.0x4a2133.3
mov edi, 0x100
nop dword [eax]
xor edx, edx
lea esi, [esi + 1]
div ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 1]
movzx eax, di
mov edi, ecx
imul edi, eax
movzx eax, byte [esi - 1]
movzx ecx, word [ebp + edx*4 - 0x14]
add di, ax
shr di, cl
movzx ecx, di
mov edi, 0x100
mov eax, ecx
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x4a2200
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ff23c
mov esp, ebp
pop ebp
ret
Function at 0x4a2fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a2ffa
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4a2ffa
push dword [ebp + 0xc]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4ad9a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x4ad9d7
push esi
call fcn.004adb90
add esp, 4
cmp byte [esi + 0x40], 0
je 0x4ad9ce
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x4ad9e2
cmp eax, 0xcb
jne 0x4ada5e
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x4ada48
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x4ad9ff
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4ada42
cmp eax, 2
je 0x4ada48
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4ad9f0
cmp eax, 3
je 0x4ada27
cmp eax, 1
jne 0x4ad9f0
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4ad9f0
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4ad9f0
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004ada90
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x4ada80
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.004ada90
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x4ada90
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
lea edi, [esi + 0x190]
mov dword [ebp + 8], edi
lea ebx, [esi + 0x78]
je 0x4adac7
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
jmp 0x4adaca
mov dword [ebp + 8], edi
mov eax, dword [edi]
cmp byte [eax + 8], 0
je 0x4adb42
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x4adb22
nop dword [eax]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4adafe
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4adb59
cmp eax, dword [esi + 0x60]
jb 0x4adae0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [edi]
cmp byte [eax + 8], 0
jne 0x4adad2
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret