joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421484
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
or dword [edi + 0x3c], 0xffffffff
lea eax, [edi + 0x1c]
push eax
call fcn.004021a5
mov esi, eax
test esi, esi
jns 0x4214b0
push str.Failed_to_copy_file_name.
jmp 0x42159c
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x24], eax
test eax, eax
jne 0x4214fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x8c
push str.cabextract.cpp
call fcn.004037d3
push str.Failed_to_create_begin_operation_event.
jmp 0x42159c
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x28], eax
test eax, eax
jne 0x42153f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x8f
push str.cabextract.cpp
call fcn.004037d3
push str.Failed_to_create_operation_complete_event.
jmp 0x42159c
push ebx
push ebx
push edi
push 0x420e43
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x42158b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x93
push str.cabextract.cpp
call fcn.004037d3
push str.Failed_to_create_extraction_thread.
jmp 0x42159c
push edi
call fcn.00421224
mov esi, eax
test esi, esi
jns 0x4215a4
push str.Failed_to_wait_for_operation_complete.
push esi
call fcn.0044012f
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4269a8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 7
pop ecx
lea edi, [ebp - 0x20]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x426a15
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1fc
push str.msuengine.cpp
call fcn.004037d3
push str.Failed_to_stop_wusa_service.
push esi
call fcn.0044012f
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0042de36
mov esp, ebp
pop ebp
ret 4
Function at 0x44082d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push 0x44
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042f670
xor eax, eax
lea edi, [ebp - 0x14]
cmp dword [ebp + 0xc], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x44b524
cmovne eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.__ls___ls
push eax
call fcn.00401f20
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x4408df
mov cx, word [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x44
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov word [ebp - 0x28], cx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4408d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x9e
push str.procutil.cpp
call fcn.004037d3
jmp 0x4408df
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [eax], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x4408f2
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x4408ff
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x44090c
push dword [ebp - 4]
call fcn.004454ef
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4439cd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x120]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x11c
push ebx
push 0
push eax
call fcn.0042f670
mov eax, dword [0x46b6e4]
add esp, 0xc
test eax, eax
jne 0x443aad
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
push 4
or ecx, eax
pop edx
mov dword [0x46b6e8], ecx
cmp dword [ebp - 0x11c], edx
jne 0x443a43
xor eax, eax
inc eax
jmp 0x443aa8
cmp dword [ebp - 0x11c], 5
jne 0x443a6e
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x443a5a
push 2
jmp 0x443aa7
cmp ecx, 1
jne 0x443a63
push 3
jmp 0x443aa7
push 9
cmp ecx, 2
pop eax
cmove eax, edx
jmp 0x443aa8
cmp dword [ebp - 0x11c], 6
jne 0x443aa5
cmp dword [ebp - 0x118], 0
jne 0x443a8e
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x443aa8
cmp dword [ebp - 0x118], 1
jne 0x443aa5
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x443aa8
push 9
pop eax
mov dword [0x46b6e4], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [0x46b6e8]
mov dword [edi], eax
pop edi
pop esi
pop ebx
call fcn.0042de36
mov esp, ebp
pop ebp
ret 8
Function at 0x5dfd58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5dfd73
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a4f98]
pop edx
test eax, eax
je 0x5dfe45
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5dfe34
test dword [ebp - 0x2a8], 1
jne 0x5dfe34
and dword [ebp - 0x2a8], 0x100
jne 0x5dfe34
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3810]
pop edx
pop esi
test eax, eax
je 0x5dfdd7
jmp 0x5dfe34
cmp word [esi], 0x5a4d
jne 0x5dfe34
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5dfe34
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3724]
pop edx
test eax, eax
je 0x5dfe34
lea eax, [ebp - 0x28c]
push eax
call fcn.005dfcb4
test eax, eax
jne 0x5dfe2d
jmp 0x5dfe34
mov eax, esi
jmp 0x5dfe45
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5dfd73
pop esi
leave
ret 4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x407ca3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x407cab
cld
cmp dword [ebp - 0xc], 0
je 0x407db6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x407cc3
add ecx, ecx
je 0x407ce2
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x407d26
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call 0x3f7d6f
jmp 0x407f17
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x407cc8
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x407d95
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x407e28
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4528e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x4528eb
cld
cmp dword [ebp - 0xc], 0
je 0x4529f6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x452903
add ecx, ecx
je 0x452922
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x452966
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.004429af
jmp 0x452b57
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x452908
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x4529d5
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x452a68
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x457f5f
Capabilities:
Encode data using xor

Disassembly:
inc ebp
jge 0x457f68
invalid
xor byte [edi + 0x7387b4ff], al
invalid
Function at 0x49d3e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x49d3eb
cld
cmp dword [ebp - 0xc], 0
je 0x49d4f6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x49d403
add ecx, ecx
je 0x49d422
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x49d466
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.0048d4af
jmp 0x49d657
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x49d408
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x49d4d5
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x49d568
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8043
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x4e804b
cld
cmp dword [ebp - 0xc], 0
je 0x4e8156
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x4e8063
add ecx, ecx
je 0x4e8082
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x4e80c6
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.004d810f
jmp 0x4e82b7
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x4e8068
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x4e8135
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x4e81c8
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x532fb3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x532fbb
cld
cmp dword [ebp - 0xc], 0
je 0x5330c6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x532fd3
add ecx, ecx
je 0x532ff2
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x533036
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call 0x52307f
jmp 0x533227
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x532fd8
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x5330a5
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x533138
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57ddc3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x57ddcb
cld
cmp dword [ebp - 0xc], 0
je 0x57ded6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x57dde3
add ecx, ecx
je 0x57de02
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x57de46
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.0056de8f
jmp 0x57e037
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x57dde8
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x57deb5
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x57df48
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c96a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x5c96ab
cld
cmp dword [ebp - 0xc], 0
je 0x5c97b6
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x5c96c3
add ecx, ecx
je 0x5c96e2
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x5c9726
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call fcn.005b976f
jmp 0x5c9917
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x5c96c8
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x5c9795
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x5c9828
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x614533
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [ebp - 8], edx
mov dword [ebp - 4], eax
jl 0x61453b
cld
cmp dword [ebp - 0xc], 0
je 0x614646
mov eax, dword [ebp - 8]
cmp al, 0
adc byte [ebx + 0xae980ca], cl
je 0x614553
add ecx, ecx
je 0x614572
dec cl
leave
dec esi
add byte [eax + 0x227406e9], al
jmp 0x6145b6
add byte [ecx], al
cld
mov edx, dword [ebp - 0xc]
call int.006045ff
jmp 0x6147a7
movzx ecx, byte [eax - 0x4b]
add al, cl
mov dword [ebp - 0x10], ecx
movzx eax, dl
add byte [ecx], al
cmp eax, 9
ja 0x614558
add byte [esi + 0x40d49d80], dh
add bh, bh
add byte [ecx], al
cmpsd dword [esi], dword es:[edi]
aam 0x40
add byte [ecx], al
mov esp, 0x40000
add byte [eax], al
add byte [edx], al
add byte [ecx], al
inc eax
add byte [ebx + 0x6140d4], bh
aam 0x40
add cl, dl
aam 0x40
add byte [eax], al
add dword [eax], eax
mov eax, dword [ebp - 0x10]
dec eax
add byte [edx], al
mov dword [ebp - 0x14], eax
jmp 0x614625
xor eax, eax
push ebp
push 0x4000d4
push dword fs:[eax]
mov dword fs:[eax], eax
add dword [ebp - 0x14], eax
imul dword [ebp - 0xc]
test byte [eax], 0xfc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
add byte [ecx], al
clc
movzx eax, byte [eax]
mov dh, 0
xor ebx, 0
cmp eax, 9
ja 0x6146b8
movzx eax, byte [eax]
add ebp, edx
inc eax
add bh, bh
and al, 0xbf
add ch, dl
inc eax
add byte [ecx], al
add al, byte [ebx]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add bh, byte [ebp - 0x5a]
add byte [eax], al
inc ecx
aad 0x40
add byte [ecx - 0x2b], bl
add byte [ecx], al
aad 0x40
add byte [eax + 0x65], dh
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 6]
add byte [ecx], al
invalid
mov al, 0xb6
add byte [esp + ebx*4 + 0x4dffffff], bh
hlt
mov eax, ebx
xchg dword [eax], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65999d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6623a8
cmp edx, dword [eax]
je 0x6599bf
add eax, 8
inc ecx
cmp eax, 0x662438
jl 0x6599b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6623a8]
jne 0x659aed
mov eax, dword [0xa5dd0c]
cmp eax, 1
je 0x659ac7
test eax, eax
jne 0x6599f0
cmp dword [0x6622d4], 1
je 0x659ac7
cmp edx, 0xfc
je 0x659aed
lea eax, [ebp - 0x1a4]
push 0x104
add dword [eax], eax
add byte [eax + 0x6a], dl
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameA
lea eax, [ebp + 8]
lea esi, [esi + 0x6623ac]
push 0
push eax
push dword [esi]
call fcn.0065a810
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]