joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098a0
Capabilities:
Encode data using xor

Disassembly:
cld
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4108dc]
push ebx
xor edx, edx
push esi
cmp eax, 0x1e
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x3a], edx
inc ebx
pop ss
mov eax, dword [ebp - 0x6b]
mov ecx, dword [ebp - 4]
push eax
push ecx
movsd dword es:[edi], dword [esi]
add eax, 0x83aa0006
sub byte [eax], cl
pop edi
mov al, byte [0x5de58b9a]
adc cl, byte [ebx - 0x3708ef38]
add byte [edx], dl
jae 0x40990f
je 0x140e010
mov esi, ecx
cmpsd dword [esi], dword es:[edi]
fild dword [ecx + 0x5d0000e6]
add byte [ecx - 0x2b760382], cl
in al, dx
je 0x409900
mov dword [ebp - 6], 0xf3000001
mov ebx, dword [ebp - 0x4d]
mov bl, 0x8b
stc
mov edi, ecx
and edi, 0x227d00
je 0x409910
push cs
retf
cld
and ecx, 0x700000
mov dword [ebp - 0x18], ecx
je 0x409921
or ebx, 4
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x14]
cmp eax, 0x38
jne 0x409a20
mov edx, dword [ebp + 0xc]
push 4
push 0xe000e0
push edx
xor eax, 0x415ffdb
shl dword [ecx], 0
add esp, 0xc
test eax, eax
jne 0x4098ff
mov eax, dword [ebp + 0xc]
inc esi
add al, 0x27
add byte [eax], al
push ebx
add eax, 0xffffffe3
push 0xe2b30180
pop es
push dword [edi]
add al, 0x14
inc eax
add byte [ebx - 0x6a7af33c], al
jne 0x409974
mov ecx, dword [ebp - 0x7e]
leave
push es
mov edx, 0xc766009b
inc ecx
mov dword [eax + eax - 0x5f], ebx
dec esp
push es
inc ecx
add byte [ebp + 0x501975c0], al
mov eax, dword [0x41064c]
test eax, eax
jne 0x409996
push eax
push 0x4e0168
push 1
in eax, dx
mov dh, 0xf
add byte [eax], al
add esp, 0xc
mov dword [0x9e064c], eax
mov ecx, 0x8b3874c0
dec ebp
call 0xf82b0d2a
fst dword [edx - 0x73]
push ebp
cmpsd dword [esi], dword es:[edi]
mov ecx, dword [ebp - 0x18]
lea esi, [ebx - 0x16]
neg ecx
push edx
lea edx, [ebp - 0x59]
sbb eax, dword [eax]
push 0
and ecx, edx
lea edx, [ebp - 0x32]
neg edi
push ecx
lea ecx, [ebp - 0x3c]
sbb edi, edi
and edi, ecx
mov ecx, dword [ebp - 4]
neg esi
sbb esi, esi
push edi
and ebx, dword [0x560c558b]
push ecx
lea ecx, [ecx + 0x5a]
xchg edi, eax
add dword [edi], ebp
call eax
jmp 0x4099d8
cmp dword [ebx], 6
jne 0x4099e6
in eax, dx
add dword [esi + eax], ecx
mov dword [edx + 0xc], 0xc93300b9
xor ecx, ecx
cmp eax, ecx
aam 0x85
mov cl, 0
add byte [eax], al
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add byte [eax], al
add byte [ebx + 0x558bf47d], cl
in al, dx
push 0x405720
push 0x409c60
xor dword [edi], eax
push edx
loope 0x4099ed
idiv dword [ebx - 0x4c160001]
add byte [eax], al
add byte [ebx + 0x577501f8], al
mov eax, dword [0x418550]
xchg ebp, eax
ret 0x1c75
inc ecx
add byte [edx - 0x51], ch
call 0x8a40a940
add esp, 0xc
mov dword [0x410650], eax
test esp, esi
je 0x409a94
dec edi
dec ebp
call 0x552cefc9
fst dword [edx - 0x73]
push ebp
invalid
rol dword [ecx], cl
invalid
Function at 0x40ad90
Capabilities:
Encode data using xor

Disassembly:
push es
mov byte [esi], 0x30
inc esi
jmp 0x40851b
mov dl, byte [eax]
mov byte [esi], dl
inc esi
inc eax
in al, dx
jne 0x40851b
mov eax, dword [ebp - 0x1f]
mov ecx, dword [ebp + 0x74]
sub esi, eax
pop edi
mov dword [ecx + 0x18], ebx
mov sp, bp
pop ebp
ret
add byte [esi - 0x75], ah
push es
rol byte [ecx + 0xfc00e2], 1
rol byte [ecx + 0xfc00e2], 1
add byte [ecx - 0x1f6eff2c], al
add byte [edi], cl
test ebp, esi
add byte [eax], al
pop dword [ecx - 0x8fc001f]
jb 0x40acac
nop
mov eax, dword [0xe1c1f600]
or bh, byte [ebx]
add esi, 2
cdq
mov ebx, eax
cli
add ebx, 0x10000
mov dword [ebp + 0x6d], esi
adc edi, 0xfffffff8
jmp 0x40ac6d
cli
loop 0x40ad0b
mov edx, edi
mov ecx, 0x86
call 0xc540b875
mov ecx, eax
cmp eax, dword [ecx]
add dl, cl
add byte [ecx - 0x46ee8b36], dh
xor dword [eax], eax
add byte [eax], al
mov ebx, 0xbbd
mov ecx, eax
inc esi
cld
retf 0xf275
invalid
pop edx
jbe 0x40ad40
dec byte [edi + 0x980080]
mov dword [ebp + 0x10], ecx
je 0x40ace0
mov edx, eax
shl dword [esi], 1
or eax, edx
dec ecx
mov dword [edi], edi
cld
mov al, bl
and al, 0x3f
mov dword [eax - 0x1f7fa808], esi
xlatb
mov byte [ecx], al
mov edx, dword [ecx + edi*4 + 6]
add byte [eax], al
add al, ch
aam 0xa
ret
ret 0x8949
fmul dword [ebx + 0x4f4efc45]
cli
jne 0x40ad1e
jg 0x40ada0
or al, 0xa
fmul dword [eax - 0x3d7400a7]
test eax, eax
mov dword [ebp + 0x1f], eax
jne 0x408510
xlatb
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3610
mov eax, 0x11178
mov word [ebx + 0x10c25d14], cs
add byte [ebx + 0x5e], bl
or byte [esi], dl
add byte [eax], al
add byte [ebx - 0x75], bl
in eax, 0x5d
cmc
adc byte [eax], al
nop
nop
nop
nop
adc eax, 0x90909090
nop
nop
nop
rcl dword [ebp - 0x2c]
push ebp
aam 0xec
mov eax, dword [ebp + 8]
sub eax, 2
je 0x40adab
add eax, 0x40c12c65
add dh, ch
aad 0xea
daa
mov edx, dword [ebx]
xor eax, eax
pop ebp
movsb byte es:[edi], byte [esi]
mov ebx, dword [esp + edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
call 0x7fae54
xor dword [ecx - 0x6f3ca2f4], 0xffffff90
nop
nop
nop
nop
nop
nop
jb 0x40ad5b
nop
jle 0x40ad69
nop
ja 0x40ae26
add eax, 0x10458bec
mov ecx, dword [ebp + 0xc]
pop edi
clc
adc byte [ebx + 0x10], dh
invalid
or dword [esi + 0x17], esi
mov eax, dword [ebp + 0x10]
inc edi
or al, byte [eax]
add byte [ebx], dl
ud0
add byte [eax], al
adc ecx, dword [edi]
call [edx + 0x79]
add byte [ecx + 0x3094fbf7], bl
mov byte [ecx], al
inc ecx
mov al, dl
add al, 0x30
mov byte [ecx], al
inc ecx
mov al, byte [0x4f9c2e01]
jne 0x40ae1e
vmwrite ecx, dword [edx + 0x5f]
pop esi
retf
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4098ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4098bb
pop dword [ebp - 0x4c]
mov eax, 0x8e8d33e4
add eax, 0x71b364d7
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3af59
push 0
mov eax, 0xa2533300
add eax, 0x5dedae20
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x8ad07b06
sub ecx, 0x8ad02ce7
mov edx, eax
mov esi, 0x417800
add esi, dword [ebp - 0x4c]
mov ebx, 0x528ffa25
sub ebx, 0x101ef93
xor dword [ebp - 0x40], 0x8e80dcdd
mov edi, dword [esi]
sub dword [ebp - 0x1c], edi
add edi, ebx
xor dword [ebp - 0x14], ecx
mov dword [edx], edi
sub dword [ebp - 0x40], 0xa59822b6
add edx, 4
add esi, 0x20a04429
add esi, 0xdf5fbbdb
loop 0x409914
add eax, 0x877c4551
add eax, 0x7884e5fe
mov ebx, eax
add eax, 0x691f93cc
add eax, 0x96e06c39
mov ecx, 0x66d795bf
sub ecx, 0x669795bf
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x415990
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415b9e
sub esp, 0x18
mov eax, dword [0x5b95f4]
test eax, eax
jne 0x415b87
nop
nop
lea eax, [0x5b95e4]
mov dword [esp], eax
call fcn.00409b60
mov eax, dword [0x5b95e8]
test eax, eax
je 0x4159d8
cmp dword [eax + 8], 0xcc
jne 0x415a4e
mov edx, dword [0x5b95ec]
test edx, edx
jne 0x415a30
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5bdd70]
mov dword [esp + 8], eax
call fcn.0040c180
mov eax, dword [esp + 0xc]
mov dword [0x5b95ec], eax
mov ecx, dword [0x5b95f0]
mov dword [eax], ecx
mov eax, dword [0x5b95ec]
mov dword [0x5b95f0], eax
movzx eax, byte [0x5b9a40]
test al, al
jne 0x415a30
xor eax, eax
jmp 0x415b58
mov edx, dword [0x5b95ec]
mov ebx, dword [edx + 4]
mov dword [0x5b95ec], ebx
mov ebx, dword [0x5b95e8]
mov dword [edx + 4], ebx
mov dword [0x5b95e8], edx
mov edx, dword [0x5b95e8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x415b37
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402a20
mov eax, dword [0x5b97c0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x415a98
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x415aae
call fcn.00466740
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x5b97c0]
test eax, eax
jne 0x415ad2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x415b00
call fcn.00466780
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x5b95e4]
mov dword [esp], eax
call fcn.00409d60
nop
lea eax, [0x5b95e0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402ba0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004667a0
lea edx, [0x5893b8]
movzx ebx, byte [edx + eax]
lea ebp, [0x5b9a40]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x415a30
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x415b41
mov ecx, 5
call fcn.00466790
lea eax, [0x4e3ce8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00437e40
nop
call fcn.00465370
jmp fcn.00415990
Function at 0x423e50
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423f53
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x423f4d
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004242a0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00424380
movzx eax, byte [esp + 0x18]
test al, 2
je 0x423f01
cmp word [esp + 0x10], 0x1f0
jbe 0x423f01
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x423f05
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x423f05
nop
jmp 0x423f05
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x423f48
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00424310
add esp, 0x1c
ret
call fcn.004667a0
call fcn.004667a0
nop
call fcn.00465370
jmp fcn.00423e50
Function at 0x423f60
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424094
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42408e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004242a0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00424470
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x424087
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00424310
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42404a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.00430ac0
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x424083
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00402960
add esp, 0x20
ret
mov eax, edx
call fcn.004667a0
call fcn.004667a0
nop
call fcn.00465370
jmp fcn.00423f60
Function at 0x429f10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a054
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00427d70
mov eax, dword [esp + 4]
test eax, eax
je 0x42a03d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x5b96c8]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.00425920
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call fcn.00409b60
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x429fa7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x429fd2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x429fbc
cmp byte [ebp + 6], bl
je 0x429fc7
cmp esi, edx
ja 0x429fce
jne 0x429fa5
cmp byte [ebp + 6], bl
jbe 0x429fa5
jmp 0x429fce
mov ebx, 1
jmp 0x429fd4
xor ebx, ebx
jmp 0x429fd4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x429ff2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call fcn.00429e10
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409d60
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x5b96c8]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42a02d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42a02d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4e54c6]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00437e40
nop
call fcn.00465370
jmp fcn.00429f10
Function at 0x42a4e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a650
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42a5e0
cmp cl, 1
je 0x42a572
cmp cl, 2
jne 0x42a639
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042fa50
nop
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409b60
mov eax, dword [0x59db84]
sub eax, dword [0x59db68]
nop
mov dword [0x59db84], eax
mov eax, dword [0x59db74]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59db74], ecx
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409d60
jmp 0x42a635
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415990
nop
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409b60
mov eax, dword [0x59db5c]
sub eax, dword [0x59db40]
nop
mov dword [0x59db5c], eax
mov eax, dword [0x59db4c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59db4c], ecx
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409d60
jmp 0x42a635
cmp cl, 3
jne 0x42a5eb
mov byte [eax + 8], 1
jmp 0x42a635
cmp cl, 4
jne 0x42a639
nop
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409b60
mov eax, dword [0x59dbd4]
sub eax, dword [0x59dbb8]
nop
mov dword [0x59dbd4], eax
mov eax, dword [0x59dbc4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59dbc4], ecx
nop
nop
lea eax, [0x59dbe0]
mov dword [esp], eax
call fcn.00409d60
add esp, 0x14
ret
lea eax, [0x4e1603]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00437e40
nop
call fcn.00465370
jmp fcn.0042a4e0
Function at 0x455090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5b96c8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45520a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x455200
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4550ea
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4550ea
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4550fd
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4551d7
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4551cb
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4551c2
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x455150
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x455193
mov eax, 1
cmp eax, ecx
ja 0x455187
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00466800
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x4551bd
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45518c
mov ecx, dword [esp + 0xc]
jmp 0x455155
call fcn.004667a0
xor eax, eax
mov ecx, eax
call fcn.00466790
call fcn.00466800
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x4551fb
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x4551d0
mov ecx, dword [esp + 0x18]
jmp 0x455102
call fcn.004667a0
xor eax, eax
mov ecx, eax
call fcn.00466790
nop
call fcn.00465370
jmp fcn.00455090