joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cbd0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x46cbeb
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x46cbe0
cmp dword [edi + 0x7c], 0
je 0x46cbfc
call fcn.0046d040
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.0046c950
add esp, 8
test eax, eax
je 0x46cc20
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0048066a
mov esi, eax
add esp, 4
test esi, esi
je 0x46cc63
push 0x4000
call fcn.0048066a
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x46cc6f
push esi
call fcn.004793e5
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
xor ecx, ecx
cmp dword [edi + 0x34], ecx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
sete cl
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
jne 0x46ccc3
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
lea ecx, [esi + 4]
call fcn.0046ba30
test eax, eax
jne 0x46ccc3
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x46cce6
mov al, byte [edi + 0x39]
jmp 0x46cce9
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x46cd66
mov al, byte [ebx]
test al, al
je 0x46cd66
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4a1bb8]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x46cd18
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d0c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x46d15a
cmp dword [edi + 4], 0xffffffff
jne 0x46d15a
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x46d0f0
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x46d11c
cmp eax, 0x2f
je 0x46d11c
mov dword [edi + esi*2 + 0x244], 0x2f
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.0046be90
add esp, 8
test eax, eax
jne 0x46d13b
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.0046c310
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46d850
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4ad1bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x46d8f1
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00482c0c
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d890
sub ecx, edx
sar ecx, 1
je 0x46d8d0
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x46d8b3
cmp eax, 0x5c
jne 0x46d8d0
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x46d9f4
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d8f1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x46d9e4
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x46d90e
cmp ax, 0x5c
jne 0x46d910
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x46d902
cmp esi, edi
je 0x46d959
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call fcn.00474330
add esp, 0xc
cmp esi, 0x208
jae 0x46d9f4
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.0046d850
xor eax, eax
mov word [ebp - 0x414], ax
pop esi
test ebx, ebx
je 0x46d97c
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00482c0c
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x414]
mov word [ebp - 0x20e], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d990
sub ecx, edx
mov eax, 0x104
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x414]
lea eax, [eax + ecx*2]
push edi
push eax
call fcn.00482c0c
xor eax, eax
add esp, 0xc
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d9e4
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047137e
mov esp, ebp
pop ebp
ret
call fcn.00471aa9
int3
Function at 0x46e560
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x46e638
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x46e594
cmp dword [esi + 0x40], ebx
jae 0x46e594
push eax
call fcn.0047138f
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x46e5ac
lea eax, [ebx + ebx]
push eax
call fcn.00471b93
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.00474330
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x46e635
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x4a3368]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x4a3368]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x46e5c2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x46e676
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x46e65d
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00474330
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x46e698
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46f810
Capabilities:
Get common file path
Get startup folder

Disassembly:
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
push 0x10
push 0x4b0ac0
push 0
call esi
test eax, eax
jne 0x46f82c
xor eax, eax
pop esi
ret
push ecx
mov ecx, dword [0x4b07d0]
lea ecx, [ecx + 4]
call fcn.004027e0
mov ecx, dword [0x4b07d0]
push 7
push str.Desktop
lea ecx, [ecx + 8]
call fcn.00404a10
mov ecx, dword [0x4b07d0]
push 7
push str.Desktop
call fcn.00404a10
push 0
push 5
push 0x4b0ac0
push 0
call esi
test eax, eax
je 0x46f828
push ecx
mov ecx, dword [0x4b07d0]
lea ecx, [ecx + 0x10]
call fcn.004027e0
mov ecx, dword [0x4b07d0]
push 9
push str.Documents
lea ecx, [ecx + 0x14]
call fcn.00404a10
mov ecx, dword [0x4b07d0]
push 9
add ecx, 0xc
push str.Documents
call fcn.00404a10
push 0
push 0xd
push 0x4b0ac0
push 0
call esi
test eax, eax
je 0x46f828
push ecx
mov ecx, dword [0x4b07d0]
lea ecx, [ecx + 0x1c]
call fcn.004027e0
mov ecx, dword [0x4b07d0]
push str.Music
lea ecx, [ecx + 0x20]
call fcn.00402870
mov ecx, dword [0x4b07d0]
push str.Music
add ecx, 0x18
call fcn.00402870
push 0
push 0x27
push 0x4b0ac0
push 0
call esi
test eax, eax
je 0x46f828
push ecx
mov ecx, dword [0x4b07d0]
lea ecx, [ecx + 0x28]
call fcn.004027e0
mov ecx, dword [0x4b07d0]
push str.Pictures
lea ecx, [ecx + 0x2c]
call fcn.00402870
mov ecx, dword [0x4b07d0]
push str.Pictures
lea ecx, [ecx + 0x24]
call fcn.00402870
mov eax, 1
pop esi
ret

Function at 0x46f950
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494cf2
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4ad1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], 0
call fcn.00402550
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x46f9b7
push 0x80004005
call fcn.00402240
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.004760a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.PCBackupWizard
lea eax, [ebp - 0x218]
push eax
push str._s_s_
push esi
call fcn.00405910
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047137e
mov esp, ebp
pop ebp
ret
Function at 0x46fc70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494d90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ad1bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46fcb4
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46fce4
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0046f950
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00403b60
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46fd2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xc
push str.hpcbwcmd.exe
lea ecx, [ebp - 0x10]
call fcn.00405e70
lea ecx, [ebp - 0x18]
call fcn.0046f950
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00403b60
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46fd6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xb
push str.pcbwcmd.exe
lea ecx, [ebp - 0x14]
call fcn.00405e70
push 0x13
push str.PCBackupSyncItems
mov ecx, 0x4b07a0
call fcn.00404a10
push 8
push 0x4a8828
mov ecx, 0x4b07a4
call fcn.00404a10
push 9
push str.PCBackup
mov ecx, 0x4b07a8
call fcn.00404a10
push 5
push str.43200
mov ecx, 0x4b07b0
mov dword [0x4b07bc], 1
mov dword [0x4b07c4], 1
call fcn.00404a10
lea eax, [ebp - 0x10]
mov ecx, 0x4b0798
push eax
call fcn.00403b60
mov esi, dword [ebp - 0x14]
xor edi, edi
nop word [eax + eax]
mov eax, dword [0x4b07d0]
mov ecx, 0x4b079c
add eax, edi
push eax
call fcn.00403b60
mov eax, dword [0x4b07d0]
push dword [edi + eax + 8]
push dword [edi + eax + 4]
push dword [0x4b07cc]
push dword [0x4b07c8]
push esi
push str._path___s___cmd___u__s__p__s___non_interactive__s__s_https:__files.pcbackupwizard.net_remote.php_webdav__s_
push 0x4b07ac
call fcn.00405910
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, 0x4b0798
cmp al, 5
jbe 0x46fe44
call fcn.00468200
jmp 0x46fe49
call fcn.00467ad0
add edi, 0xc
cmp edi, 0x30
jl 0x46fdf0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46fe6c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x46fe8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487c64
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487ae3

Function at 0x48c751
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048c411
Function at 0x4d0210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
or ebp, 0xffffffff
jmp 0x4d0232
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d0239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0228
mov eax, 1
add ebx, ebx
jne 0x4d024b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d025c
jne 0x4d027b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d027b
dec eax
add ebx, ebx
jne 0x4d0268
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d0240
add ebx, ebx
jne 0x4d0277
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d02cd
xor ecx, ecx
sub eax, 3
jb 0x4d0293
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d0302
sar eax, 1
mov ebp, eax
jmp 0x4d029e
add ebx, ebx
jne 0x4d029e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d026c
inc ecx
add ebx, ebx
jne 0x4d02ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d026c
add ebx, ebx
jne 0x4d02b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d02ae
jne 0x4d02ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d02ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d02ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d02de
jmp 0x4d022e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d02ec
add edi, ecx
jmp 0x4d022e
pop esi
mov edi, esi
mov ecx, 0x3493
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d030a
cmp byte [edi], 0x4c
jne 0x4d030a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d030f
lea edi, [esi + 0xcc000]
mov eax, dword [edi]
or eax, eax
je 0x4d0387
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf86d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf882c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d033c
mov ecx, edi
jns 0x4d036b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf8830]
or eax, eax
je 0x4d0381
mov dword [ebx], eax
add ebx, 4
jmp 0x4d0359
call dword [esi + 0xf8840]
mov ebp, dword [esi + 0xf8834]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d03bb
sub esp, 0xffffff80
jmp 0x417770
Function at 0x55c1af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
jbe 0x5f363b
bsf edi, ebx
or edi, 0x4e0c3275
mov edi, dword [edx + 0x24]
clc
add edi, eax
bswap ebx
dec cx
mov ebx, dword [edx + 0x20]
sal cl, 2
bsr cx, bx
add ebx, eax
movsx cx, dl
mov dword [ebp - 8], 0
inc ecx
mov ecx, dword [edx + 0x18]
bt eax, ebx
cmp ecx, dword [ebp - 8]
call fcn.0056ef7f
call fcn.0056fb8c
add byte [eax], al
inc edi
je 0x55c252
imul esp, dword [ebx + 0x6b], 0x6e756f43
je 0x55c23d
xor al, 0
mov dh, 0xca

Function at 0x55d4e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jb 0x55d0e4
sbb al, 0xb0
lahf
neg ax
aad 0x12
mov eax, 6
clc
test di, ax
push ecx
sub ecx, eax
setg al
mov al, byte [ebp - 2]
push 0xf110cd37
jmp 0x57a44e
stosb byte es:[edi], al
pushal
push 0xcf617b27
pushfd
pushfd
lea esp, [esp + 0x34]
jmp 0x55e42f

Function at 0x55d512
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0x50
pushfd
push ebx
stosb byte es:[edi], al
push dword [esp]
push dword [esp]
pushal
lea esp, [esp + 0x3c]
jmp 0x55e42f

Function at 0x560d67
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x2c]
jb 0x560fca
cmc
cmp dl, 0x56
xor dh, dl
stc
pushfd
cmp bl, 0x1e
pushal
test dh, 1
pushfd
setnp dh
mov dh, 0
push 0x5920c683
lea esp, [esp + 0x2c]
je 0x5f4d3b

Function at 0x56fa83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x56fbd4
mov word [esp + 4], 0x8470
Function at 0x5885ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
ja 0x57a2f9
push esi
mov word [esp], bx
pushal
lea esp, [esp + 0x24]
jb 0x55e482
cmp edi, ecx
clc
push esi
mov dword [esp], eax
cmp byte [edi - 1], 0
mov dword [esp], 0x71b8ddc2
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jne 0x579cb0
not di
btc di, dx
bswap edi
mov edi, dword [edx + 0x24]
push edi
mov byte [esp], dh
push dword [esp]
add edi, eax
jmp 0x5f3984
test ecx, 0xac3f619a
movzx ecx, word [edi + ecx*2]
sub esp, 0xfffffff8

Function at 0x588e4b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp bx, 0x9aea
cmc
cmp ecx, dword [edx + 0x14]
jmp 0x5f4355
pushal
lea esp, [esp + 0x24]
Function at 0x406810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec eax
cwde
cmc
wait
dec edx
cwde
inc eax
xchg ecx, eax
inc ecx
xchg ecx, eax
inc ebx
aas
daa
lahf
dec ebx
lahf
inc ebx
dec ebx
wait
aaa
inc eax
dec edx
daa
inc edx
inc ebx
inc eax
das
xchg ebx, eax
clc
cld
std
dec edx
inc ebx
inc eax
inc eax
salc
inc eax
inc ebx
dec ecx
inc ebx
inc ebx
cwde
xchg edx, eax
cmc
inc ecx
cld
daa
aas
inc edx
wait
dec eax
wait
das
inc eax
inc eax
inc eax
dec ebx
xchg ecx, eax
wait
std
cld
inc edx
aaa
cld
std
inc eax
lahf
std
dec ecx
dec edx
nop
inc ecx
nop
inc ecx
aaa
inc ecx
wait
aas
xchg edx, eax
aas
xchg ecx, eax
salc
das
jmp 0x40668c
jmp 0x406699
cld
jmp 0x4066aa
call fcn.0040696b
nop
jmp 0x4066ba
jmp 0x4066c8
jmp 0x4066d6
nop
pushal
nop
jmp 0x4066e4
mov ebp, esp
nop
jmp 0x4066f5
xor edx, edx
nop
jmp 0x406705
mov edx, dword fs:[edx + 0x30]
nop
mov edx, dword [edx + 0xc]
nop
mov edx, dword [edx + 0x14]
jmp 0x40671e
nop
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
nop
xor edi, edi
nop
jmp 0x40673b
nop
xor eax, eax
nop
jmp 0x40674e
lodsb al, byte [esi]
cmp al, 0x61
nop
jl 0x406765
nop
sub al, 0x20
jmp 0x406765
ror edi, 0xd
nop
add edi, eax
nop
jmp 0x40677d
dec ecx
nop
jmp 0x40678b
jne 0x40673b
nop
push edx
nop
push edi
nop
jmp 0x4067a2
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
nop
jmp 0x4067b7
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
jmp 0x4067cf
je 0x40694d
nop
jmp 0x4067e6
add eax, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x4067f7
push eax
nop
mov ebx, dword [eax + 0x20]
nop
jmp 0x40680c
add ebx, edx
nop
test ecx, ecx
nop
je 0x406939
nop
jmp 0x406823
nop
jmp 0x40682e
xor edi, edi
dec ecx
jmp 0x40683b
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
nop
jmp 0x406855
add edi, eax
nop
cmp al, ah
nop
jmp 0x406868
jne 0x406842
nop
jmp 0x406880
nop
jmp 0x40688f
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
nop
jmp 0x4068a2
jne 0x40680f
nop
nop
jmp 0x4068bb
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x4068cd
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
jmp 0x40694b
pop eax
nop
pop edi
pop edx
mov edx, dword [edx]
jmp 0x406965
jmp 0x40671e

Function at 0x40add0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp eax, 0x10
jae 0x40adf5
salc
wait
sub al, 0xc1
inc eax
add byte [ebp*2 - 0x36ffffe4], al
xor eax, eax
pop ebp
pop es
push ebx
push esi
mov ebp, dword [edi + 0x55]
inc edx
mov edi, 0x2c04
add al, 0x2c
add byte [eax], al
mov al, byte [ebp + 0x46]
packsswb mm1, qword [eax + 0x1a76d445]
mov eax, dword [ebp + 0x10]
mov ebx, 0xd60064
and eax, 0x14ff
cdq
idiv ebx
inc ebp
xor byte [eax + 0x1826055], cl
inc ecx
popfd
add al, 0x3c
or dword [esi + 0x17], esi
mov esi, dword [edx + 0x790abb10]
jge 0x40ae29
and eax, 0xff
cdq
idiv ebx
add al, 0x30
mov byte [ecx], al
inc ecx
xchg dl, al
add al, 0x30
mov byte [ebx + 0x1e], bh
test byte [ecx], 0x42
inc ecx
dec edi
jne 0x40adf9
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov byte [ecx - 1], 0
pop ebx
pop ebp
ret