joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408297
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x490040]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
sub eax, 0x100
je 0x4083b5
sub eax, 1
je 0x4083a5
sub eax, 1
je 0x408318
dec eax
sub eax, 1
je 0x4083b5
sub eax, 5
jne 0x408458
mov ecx, dword [ebp + 0xc]
cmp ecx, 0xffff
je 0x408310
cmp byte [edi + 0x7a0], al
jne 0x408310
xor ebx, ebx
lea esi, [esp + 0xc]
mov edx, esi
mov dword [esp + 0xc], ebx
mov word [esp + 0x10], bx
call fcn.00412f32
push eax
push esi
push ebx
jmp 0x408399
xor eax, eax
inc eax
jmp 0x40845a
mov esi, dword [ebp + 0xc]
cmp esi, 0x80
jae 0x40833b
push esi
call fcn.0045e990
pop ecx
test eax, eax
je 0x40833b
cmp byte [edi + 0x7a0], 0
jne 0x408458
xor eax, eax
mov word [esp + 0xc], si
mov dword [esp + 0xe], eax
xor ecx, ecx
mov edx, dword [esp + 0xc]
mov ebx, 0x3ff
inc ecx
lea eax, [edx + 0x2800]
cmp ax, bx
ja 0x408369
mov word [edi + 0x7a2], si
jmp 0x408458
lea eax, [edx + 0x2400]
cmp ax, bx
ja 0x408391
mov ax, word [edi + 0x7a2]
mov word [esp + 0xc], ax
xor eax, eax
push 2
mov word [esp + 0x12], si
mov word [edi + 0x7a2], ax
pop ecx
push ecx
lea eax, [esp + 0x10]
push eax
push 0
mov ecx, edi
call fcn.004074b3
jmp 0x408458
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x101
jmp 0x40848b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov byte [edi + 0x7a0], 0
call esi
mov ebx, dword [ebp + 0xc]
cwde
shr eax, 0x1f
mov dword [esp + 0xc], eax
test al, al
je 0x408410
test dword [ebp + 0x10], 0x1000000
jne 0x408410
cmp ebx, 0x25
ja 0x40846e
je 0x408484
mov eax, ebx
sub eax, 0xc
je 0x408484
sub eax, 0x15
je 0x408484
sub eax, 1
je 0x408484
sub eax, 1
je 0x408484
sub eax, 1
je 0x408484
push 0x11
call esi
movsx esi, ax
push 0x10
shr esi, 0x1f
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
mov eax, dword [esp + 0xc]
movzx eax, al
shr ecx, 0x1f
shl eax, 2
or ecx, eax
lea eax, [esi + esi]
or ecx, eax
lea esi, [edi + 0x7a0]
push esi
push ecx
mov ecx, ebx
call fcn.0040655b
push eax
mov ecx, edi
call fcn.00434b52
test eax, eax
jne 0x408458
cmp byte [esi], al
je 0x408484
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00457c53
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
sub eax, 0x26
je 0x408484
sub eax, 1
je 0x408484
sub eax, 1
je 0x408484
sub eax, 5
jne 0x408410
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x40845a

Function at 0x409af3
Capabilities:
Open clipboard

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
test esi, esi
jle 0x409b0c
xor eax, eax
lea ecx, [esi - 1]
inc eax
shl eax, cl
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x409b21
inc esi
cmp esi, 8
jl 0x409af9
xor al, al
jmp 0x409b23
mov al, 1
pop edi
pop esi
ret
Function at 0x409b42
Capabilities:
Read clipboard data

Disassembly:
push 0x34
mov eax, 0x47474e
call fcn.004585ca
mov esi, ecx
mov ecx, dword [esi + 0x2a4]
call fcn.00409af3
test al, al
je 0x409ce8
mov eax, dword [esi + 0x298]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x3c], cl
mov ecx, eax
mov dword [ebp - 0x40], eax
call fcn.00405bc0
xor ebx, ebx
lea ecx, [esi + 0x238]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
call fcn.004161c4
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test al, al
je 0x409bbd
movzx eax, word [esi + 0x7be]
push eax
call edi
test eax, eax
jne 0x409bb5
movzx eax, word [esi + 0x7c0]
push eax
call edi
test eax, eax
je 0x409bbd
push 2
pop eax
mov dword [ebp - 0x30], eax
jmp 0x409bc0
mov dword [ebp - 0x30], ebx
xor eax, eax
mov ecx, esi
inc eax
cmp dword [esi + 0x520], eax
sete al
movzx eax, al
push eax
call fcn.0043077e
movzx eax, word [esi + 0x7ba]
push eax
call edi
test eax, eax
setne bl
test eax, eax
jne 0x409c3b
movzx eax, word [esi + 0x7bc]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor eax, eax
inc eax
mov byte [ebp - 4], al
test edi, edi
je 0x409c3e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x409c3b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x409c2c
mov eax, dword [ebp - 0x2c]
cmp byte [eax], 2
jne 0x409c2c
mov bl, cl
jmp 0x409c30
xor eax, eax
mov bl, al
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
test bl, bl
mov ebx, dword [ebp - 0x30]
push 0xd
cmovne ebx, eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor eax, eax
mov byte [ebp - 4], 3
mov ecx, eax
test edi, edi
je 0x409c67
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
xor eax, eax
mov byte [ebp - 4], al
test ecx, ecx
je 0x409ccc
push ecx
push ecx
mov edx, esp
lea eax, [ecx + 2]
mov dword [ebp - 0x2c], eax
mov dword [edx], ecx
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x34]
jne 0x409c7a
sub ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
push eax
call fcn.00407a8b
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov ecx, esi
push ebx
push dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
push eax
call fcn.004305f1
push edi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], al
call fcn.0040bb37
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x38]
call fcn.00405c11
call fcn.00458579
ret
Function at 0x40a988
Capabilities:
Write clipboard data

Disassembly:
push 0xc
mov eax, 0x47498c
call fcn.00458597
mov edi, ecx
mov ecx, dword [edi + 0x2a4]
call fcn.00409af3
test al, al
je 0x40aa74
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
mov ecx, edi
and dword [ebp - 0x14], 0
push esi
push eax
call fcn.0040a8df
cmp dword [ebp - 0x14], 0
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x40a9ea
and dword [ebp - 4], 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
push 0xd
call ebx
cmp byte [esi + 0x18], 0
je 0x40aa50
movzx eax, word [edi + 0x7ba]
push 0
push eax
call ebx
and dword [ebp - 0x14], 0
xor eax, eax
inc eax
push eax
push 0x42
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40aa24
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov eax, dword [ebp - 0x10]
jmp 0x40aa27
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x40aa50
mov byte [ecx], 2
movzx esi, word [edi + 0x7bc]
push eax
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x10]
push esi
call ebx
mov esi, dword [ebp + 8]
cmp byte [esi + 0x19], 0
je 0x40aa6e
movzx eax, word [edi + 0x7be]
push 0
push eax
call ebx
movzx eax, word [edi + 0x7c0]
push 0
push eax
call ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.00458565
ret 4
Function at 0x420161
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4202f7
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4202f7
cmp eax, 0x29
jne 0x4201cd
cmp dword [esi + 0x10], 0
jne 0x4202f7
test dword [esi + 0x50], edx
je 0x4202fd
cmp eax, 0x5d
jne 0x4201a8
test dword [esi + 0x50], edx
je 0x42028d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00421b6b
mov bl, 1
mov ecx, esi
call fcn.00420139
test bl, bl
je 0x4201c9
mov ecx, esi
call fcn.00421a85
mov cl, 1
jmp 0x420168
cmp eax, 0x2e
jne 0x4201e5
push 5
lea ecx, [esi + 0x24]
call fcn.004203c7
mov ecx, esi
call fcn.00420139
jmp 0x4201c2
cmp eax, 0x5c
jne 0x420231
mov ecx, esi
call fcn.00420139
test byte [esi + 0x50], 0x80
je 0x420228
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x420211
push 4
lea ecx, [esi + 0x24]
call fcn.004203c7
mov ecx, esi
call fcn.00420139
jmp 0x4201c9
cmp al, 0x42
jne 0x420228
push 4
lea ecx, [esi + 0x24]
call fcn.004203c7
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x420208
mov ecx, esi
call fcn.0042191e
jmp 0x4201c2
cmp eax, 0x5b
jne 0x420291
mov ecx, esi
call fcn.00420139
lea ecx, [esi + 0x24]
call fcn.00423557
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x42025e
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00420139
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x42027c
cmp eax, 0x5d
jne 0x42027c
push eax
lea ecx, [esi + 0x24]
call fcn.004235a1
mov ecx, esi
call fcn.00420139
mov ecx, esi
call fcn.00423246
cmp dword [esi + 0x4c], 0x5d
je 0x4201dc
push 4
jmp 0x4202ff
cmp eax, 0x28
jne 0x4202b1
mov ecx, esi
call fcn.00420139
mov ecx, esi
call fcn.004219f6
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4202fd
jmp 0x4201b7
cmp eax, 0x5e
jne 0x4202bd
push 2
jmp 0x420200
cmp eax, 0x24
jne 0x4202c9
push 3
jmp 0x420200
cmp eax, 0x2a
je 0x4202f3
cmp eax, 0x2b
je 0x4202f3
cmp eax, 0x3f
je 0x4202f3
cmp eax, 0x7b
je 0x4202f3
cmp eax, 0x7d
jne 0x42019a
test dword [esi + 0x50], edx
jne 0x4201a8
push 6
jmp 0x4202ff
push 0xa
jmp 0x4202ff
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.0041f5e0
int3
Function at 0x421c5a
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x421df5
mov edx, 0x10000000
cmp eax, 0x7c
je 0x421df5
cmp eax, 0x29
jne 0x421cc6
cmp dword [esi + 0x10], 0
jne 0x421df5
test dword [esi + 0x50], edx
je 0x421dfb
cmp eax, 0x5d
jne 0x421ca1
test dword [esi + 0x50], edx
je 0x421d8b
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00423a1a
mov bl, 1
mov ecx, esi
call fcn.00421c31
test bl, bl
je 0x421cc2
mov ecx, esi
call fcn.00423956
mov cl, 1
jmp 0x421c61
cmp eax, 0x2e
jne 0x421cde
push 5
lea ecx, [esi + 0x24]
call fcn.004203c7
mov ecx, esi
call fcn.00421c31
jmp 0x421cbb
cmp eax, 0x5c
jne 0x421d2f
mov ecx, esi
call fcn.00421c31
test byte [esi + 0x50], 0x80
je 0x421d26
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x421d0e
push 4
lea ecx, [esi + 0x24]
call fcn.004203c7
mov ecx, esi
call fcn.00421c31
jmp 0x421cc2
cmp ecx, 0x42
jne 0x421d26
push 4
lea ecx, [esi + 0x24]
call fcn.004203c7
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x421d05
mov ecx, esi
call fcn.004237ef
jmp 0x421cbb
cmp eax, 0x5b
jne 0x421d8f
mov ecx, esi
call fcn.00421c31
lea ecx, [esi + 0x24]
call fcn.00425f57
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x421d5c
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00421c31
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x421d7a
cmp eax, 0x5d
jne 0x421d7a
push eax
lea ecx, [esi + 0x24]
call fcn.00425fa1
mov ecx, esi
call fcn.00421c31
mov ecx, esi
call fcn.00425c67
cmp dword [esi + 0x4c], 0x5d
je 0x421cd5
push 4
jmp 0x421dfd
cmp eax, 0x28
jne 0x421daf
mov ecx, esi
call fcn.00421c31
mov ecx, esi
call fcn.004238c7
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x421dfb
jmp 0x421cb0
cmp eax, 0x5e
jne 0x421dbb
push 2
jmp 0x421cfd
cmp eax, 0x24
jne 0x421dc7
push 3
jmp 0x421cfd
cmp eax, 0x2a
je 0x421df1
cmp eax, 0x2b
je 0x421df1
cmp eax, 0x3f
je 0x421df1
cmp eax, 0x7b
je 0x421df1
cmp eax, 0x7d
jne 0x421c93
test dword [esi + 0x50], edx
jne 0x421ca1
push 6
jmp 0x421dfd
push 0xa
jmp 0x421dfd
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.0041f5e0
int3
Function at 0x4291b6
Capabilities:
Hide graphical window

Disassembly:
push 0x84
mov eax, 0x475e74
call fcn.004585ca
mov ebx, ecx
mov ecx, dword [ebx + 0x6cc]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, 0xffffffff
jne 0x4291e3
mov ecx, ebx
call fcn.00428ef8
jmp 0x429321
push eax
lea eax, [ebp - 0x28]
lea ecx, [ebx + 0x684]
push eax
call fcn.0042ab93
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x6cc]
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x64
lea eax, [ebp - 0x90]
push esi
push eax
call fcn.0045ae70
mov ecx, dword [ebx + 0x790]
mov eax, 0x7e6
test ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x68], esi
lea esi, [ebp - 0x90]
lea edx, [eax - 8]
cmovg eax, edx
mov dword [ebp - 0x88], eax
movsx eax, byte [ebp + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x6d0]
sub eax, dword [ebx + 0x6d4]
cmp dword [ebp - 0x14], 0xf
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
sub esp, 0x58
mov dword [ebp - 0x74], eax
mov eax, dword [ebx]
push 0x19
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call dword [eax + 0x88]
lea ecx, [ebx + 0x684]
cmp byte [ecx], 0
je 0x429319
call fcn.0042abe6
cmp dword [ebx + 0x790], 0
jg 0x429319
mov ecx, dword [ebx + 0x260]
mov eax, dword [ebx + 0x238]
add ecx, ecx
cmp byte [ebx + 0x6da], 0
mov eax, dword [eax + ecx*8]
je 0x4292ca
mov ecx, dword [ebx + 0x298]
push 1
push 1
push eax
call fcn.0041b723
mov edx, dword [ebp - 0x84]
cmp eax, edx
jl 0x429319
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
cmova ecx, dword [ebp - 0x28]
sub eax, edx
push ecx
push eax
push edx
mov ecx, ebx
call fcn.0042882f
mov ecx, ebx
call fcn.0042de40
mov eax, dword [ebx]
lea esi, [ebp - 0x90]
sub esp, 0x64
mov dword [ebp - 0x88], 0x7ee
push 0x19
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call dword [eax + 0x88]
lea ecx, [ebp - 0x28]
call fcn.0040bb37
call fcn.00458579
ret 8
Function at 0x42b304
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], esi
mov ecx, edi
lea eax, [edx - 1]
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x42b35a
lea esi, [ecx + ecx]
lea ecx, [ebx + 8]
lea ecx, [ecx + esi*4]
lea eax, [ecx - 4]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.0042b0db
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x42b326
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp ecx, eax
jne 0x42b36d
test dl, 1
jne 0x42b36d
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebx + edi*4], eax
lea edi, [edx - 1]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], eax
cmp esi, edi
jge 0x42b39c
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
lea ecx, [ebp + 8]
lea eax, [ebx + esi*4]
push eax
call fcn.0042b0db
test al, al
je 0x42b39c
mov eax, dword [ebx + esi*4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x42b377
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], edi
lea esi, [edx - 1]
mov eax, esi
mov dword [ebp - 0xc], esi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x43e4b4
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
mov ecx, dword [ebx + esi*4 + 8]
call fcn.0042b5c7
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x43e486
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
cmp ecx, eax
jne 0x43e4c6
test dl, 1
jne 0x43e4c6
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
lea esi, [edi - 1]
sar esi, 1
cmp dword [ebp - 4], edi
jge 0x43e4f8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [ebx + esi*4]
call fcn.0042b5c7
test al, al
je 0x43e4f8
mov eax, dword [ebx + esi*4]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + edi*4], eax
mov edi, esi
dec esi
sar esi, 1
cmp dword [ebp - 4], edi
jl 0x43e4d8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43e8f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [eax - 1]
mov dword [ebp - 4], ecx
mov edi, edx
mov dword [ebp - 0xc], ebx
sar ebx, 1
mov dword [ebp - 8], edi
cmp edi, ebx
jge 0x43e954
lea esi, [edx + edx]
lea eax, [esi + 2]
shl eax, 4
add ecx, eax
lea eax, [ecx - 0x10]
push eax
call fcn.0042b5c7
mov ecx, dword [ebp - 4]
lea edx, [esi + 1]
movzx eax, al
xor eax, 1
shl edi, 4
add edx, eax
add edi, ecx
mov esi, edx
shl esi, 4
add esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, edx
cmp edx, ebx
jl 0x43e919
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x43e970
test al, 1
jne 0x43e970
shl eax, 4
shl edi, 4
lea esi, [eax - 0x10]
add esi, ecx
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
jge 0x43e9a2
push dword [ebp + 0xc]
lea ebx, [edi - 1]
sar ebx, 1
mov esi, ebx
shl esi, 4
add esi, ecx
mov ecx, esi
call fcn.0042b5c7
mov ecx, dword [ebp - 4]
test al, al
je 0x43e9a2
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
cmp dword [ebp - 8], ebx
jl 0x43e975
mov esi, dword [ebp + 0xc]
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43f161
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
test edi, edi
je 0x43f1e4
lea eax, [esi + 1]
mov dword [ebp - 8], 0xff
lea edx, [ecx + 1]
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
sub esi, ecx
push ebx
mov bl, byte [eax + 2]
movzx eax, byte [esi + edx - 1]
xor edx, edx
movzx ecx, bl
imul eax, ecx
div dword [ebp - 8]
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
imul eax, ecx
div dword [ebp - 8]
mov edx, dword [ebp - 4]
mov byte [edx], al
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 1]
imul eax, ecx
mov ecx, 0xff
div ecx
mov edx, dword [ebp - 4]
mov byte [edx - 1], al
mov eax, dword [ebp + 8]
mov byte [edx + 2], bl
add eax, 4
add edx, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
sub edi, 1
jne 0x43f187
pop ebx
pop edi
pop esi
leave
ret
Function at 0x45892f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45896e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45896e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45896e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45896e
cmp dword [ecx + 0x74], 0xe
jbe 0x45896e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x46616e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47c6bc
push 0x47c6b4
push str.FlsAlloc
push 0x1f
call fcn.00466036
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4661a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x47848c]
call esi
jmp 0x4661a8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4661ec
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47c6cc
push 0x47c6c4
push str.FlsGetValue
push 0x21
call fcn.00466036
mov esi, eax
add esp, 0x10
test esi, esi
je 0x466223
push dword [ebp + 8]
mov ecx, esi
call dword [0x47848c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x46622b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47c6d4
push 0x47c6cc
push str.FlsSetValue
push 0x22
call fcn.00466036
mov esi, eax
add esp, 0x10
test esi, esi
je 0x466265
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x47848c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4674e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x492c78]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x467524
cmp byte [ebx], 0xa
jne 0x467524
or byte [edi + eax + 0x28], 4
jmp 0x467529
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x467628
mov dl, byte [eax]
cmp dl, 0x1a
je 0x46760b
inc eax
cmp dl, 0xd
je 0x467555
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x46757b
cmp eax, ecx
jae 0x467589
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x46753d
jmp 0x467628
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x467606
cmp dword [ebp - 0x10], 0
je 0x467606
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x492c78]
test byte [eax + edi + 0x28], 0x48
je 0x4675e0
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4675cb
mov byte [esi], dl
jmp 0x4675dc
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x492c78]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x467628
cmp byte [ebp - 1], 0xa
jne 0x4675ef
cmp esi, ebx
jne 0x4675ef
mov byte [esi], 0xa
jmp 0x467627
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0046e241
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x467628
mov byte [esi], 0xd
jmp 0x467627
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x492c78]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x467625
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x467628
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret