joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429380
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b7820]
sub esp, 0x574
push ebx
push ebp
push esi
shr eax, 3
xor ebx, ebx
push edi
mov edi, dword [0x437884]
cmp eax, ebx
jbe 0x429568
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x4293b6
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0x7b7820], 0x1c
jne 0x4293cd
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x42e700]
mov eax, dword [0x42e704]
mov esi, dword [edi]
mov ebp, dword [0x42e708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42e70c]
mov edi, 0xc6ef3720
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], 0x20
jmp 0x42940a
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x28]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0x7b67a4], ebx
mov eax, dword [esp + 0x18]
add dword [0x7b67a4], eax
mov edx, dword [0x7b67a4]
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
cmp dword [0x7b7820], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x4294a4
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0x7b7820], 0x979
mov dword [0x7b67a8], 0xff6b3619
mov dword [0x7b67ac], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x4294eb
push 0
lea eax, [esp + 0x184]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0x7b7820]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x42950d
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x429408
cmp eax, 0x8d4
jne 0x429524
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], ecx
cmp dword [0x7b7820], 0x17
jne 0x429557
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x4293b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x574
ret
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x438cb0
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub ebx, ebx
call fcn.00438cde
sub eax, 0xd0f3b60e
add eax, eax
xor dword [edi], esi
sub eax, eax
inc edi
inc ebx
cmp edi, ecx
jne fcn.00438cb0
mov eax, eax
add ebx, 1
ret
Function at 0x44212d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44215b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442179
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442097
jmp 0x442179
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442179
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442097
test edi, edi
mov eax, edi
jne 0x442163
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c32c]
test ecx, ecx
je 0x44222c
jmp 0x44212c
ret 8

Function at 0x5d8ab7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
dec ebx
add ebx, 0xb30240f2
call fcn.005d8afd
mov ebx, ebx
and ebx, edi
xor dword [edx], eax
mov edi, 0x9a723a17
add edi, 1
sub ebx, 0xddc3d293
add edx, 2
inc edi
cmp edx, esi
jl fcn.005d8ab7
add ebx, 0xec057c37
sub edi, 0xabd6d3e7
ret
Function at 0x44b068
Capabilities:
Encode data using xor

Disassembly:
ret
mov ebx, eax
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44ac71
push 0
jmp 0x44af17
push eax
lea eax, [ebp - 0x10]
je 0x44afa6
jne 0x44afa6
mov dword [0x112a0a9c], eax
mov byte [ebp - 0x10a], al
mov dword [0xf35bf8], eax
push 0xaeb198
push 0x697ba8b8
mov dword [0x1bf1c192], eax
lcall 0xfbde, 0x53d8f494
pop ebx
inc ebp
cmp esi, eax
jle 0x44ac71
push 0x44b019
ret
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xfffffffe
jmp 0x44adbe
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
jmp 0x44ae9e
test eax, eax
je 0x44adcf
push 0
push eax
call dword [fcn.00401030]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
jmp 0x44ad68
mov esp, ebp
pop ebp
je 0x44aa06
jne 0x44aa06
cmp dword [ebp - 0x94], 0x10
mov ecx, 0x1011cd04
call dword [0x9a828c]
cmp dword [0xe4c718], 0
cmp dword [ebp - 8], 0x8000000a
cmp ecx, 0x417558
mov eax, 0x1004888c
push 0xa94808
cmp byte [ecx + 0xd3a478], 0
push 0x102a3bc0
mov ecx, dword [0xd77e20]
push 0x8c4580
push 0x1153ee14
cwde
xor eax, 0xb2dfffbc
mov gs, edi
and dh, dh
loopne 0x44ae3d
loopne 0x44aeb1
push esi
push edi
mov eax, dword [0x5976c0]
xor dword [ebp - 8], eax
xor eax, ebp
je 0x44ab06
jne 0x44ab06
cmp byte [edx - 0x6deceffc], dl
mov edi, 0x66
mov eax, dword [ebp - 0x112c]
pxor xmm2, xmm6
mov bl, byte [0x6999830c]
ljmp 0xf896
pop ebx
je 0x44adf7
jne 0x44adf7
mov eax, 0x105a8128
mov byte [ebp - 0xf7], dl
push 0x1020d610
mov dword [ebp + eax*8 - 0x21c], edi
sub ecx, dword [0x424ec0]
cmp dword [0x424340], esi
cmp dword [0xf54f00], esi
mov eax, 0x53605c
mov ecx, dword [0x557794]
mov byte [ebp - 0x42c], bl
movzx eax, byte [ebp - 0x158]
and cl, 0xc4
mov dword [0x4389d0], eax
mov eax, 0xf7da18
jmp dword [0x44b4f4]
xchg ebp, eax
or edi, edi
invalid
push eax
call dword [fcn.00401030]
xor eax, eax
push 0x44ad24
ret
mov dword fs:[0], eax
push 0x44ace4
ret
sti
xchg edx, eax
mov ch, 0xb
je 0x44ac6e
push edi
push esi
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0044a680
add esp, 0xc
jmp 0x44aa94
Function at 0x4799f0
Capabilities:
Encode data using xor

Disassembly:
push esi
je 0x479ab0
jne 0x479ab0
mov ecx, dword [0x1153d864]
mov dword [0x111d42e4], ecx
push 0xbdaa5c
push 0x45e650
push 0xb63258
cmp cl, 0xa
add byte [eax + 0x50], ch
out 0x45, al
add byte [eax + 0x58], ch
xor dh, byte [esi + 0xaf98000]
mov dword [esi + 0x20], 0x11417ad0
call dword [0x69972a4c]
mov esi, 0xd2345e07
mov edx, edx
sbb byte [edx + 0x6ad88b3], ch
xchg ebx, eax
push esp
dec ecx
jno 0x479a0d
add esp, 8
cmp esi, dword [eax - 8]
jg 0x479ec0
mov dword [eax - 0xc], esi
mov edx, dword [edi]
xor eax, eax
jmp 0x479ba8
push edi
mov edi, ecx
push 0x479dc9
ret
sub edx, esi
or ecx, edx
jmp 0x479d67
ret
mov word [edx + esi*2], ax
je 0x479c02
jne 0x479c02
mov dword [0x69998354], eax
mov dword [0xcfa5fc], edx
mov eax, 0x102bfd18
jmp dword [esi*4 + 0x89d170]
mov eax, edi
pop edi
pop esi
je 0x479b5b
jne 0x479b5b
push 0x114cbc0c
mov dword [0x462dbc], eax
push 0x44c220
mov dword [0x456730], edx
cmp eax, dword [0x1000c0f0]
jmp dword [0x43b1b8]
push eax
push ecx
call 0x483304
mov eax, dword [edi]
push 0x479a3a
ret
sub ecx, dword [eax - 4]
jmp 0x479af5
jge 0x479e05
jmp 0x479e69
mov ecx, dword [edi]
lea eax, [esi + 1]
je 0x479c83
jne 0x479c83
mov byte [edx + 0x50], 0
add ecx, 0xee8
or ecx, dword [0xd37bfc]
push 0x1004f888
fldenv [ecx - 0x6c]
call dword [0x44b088]
push 0x9c6934
mov edx, 0x1869f
mov dword [esi], 0xedfcbc
sub ecx, dword [ebp - 0x758]
jmp dword [ecx*4 + 0x101ea650]
xchg byte [ecx], al
add bh, al
push es
mov esp, 0x2b00edfc
lea ebp, [eax - 8]
and al, 0x8d
push eax
cmpsb byte [esi], byte es:[edi]
push ds
adc bh, bh
adc eax, 0x507568
fstp dword [esi + 0x114]
retf
push esi
mov ecx, edi
je 0x479f08
jne 0x479f08
div dword [0x69a76750]
mov byte [ebp - 0x107], dl
push 0xa154e8
mov dword [0xdeef3c], 0x60e910
mov eax, dword [0x1153faec]
mov dword [0x423f64], 9
fst qword [esi - 0x68f4ff75]
push 0xa11f20
mov eax, dword [0x10120230]
sub dword [edx + 0x67], ebp
and ecx, dword [eax]
ja 0x479e3b
dec ebp
jns 0x479eca
push 0x80070057
call fcn.004374e0
mov edx, dword [eax - 8]
mov ecx, 1
je 0x479cfe
jne 0x479cfe
cmp edi, 0x42
push 0x102a9180
push 0x105095fc
cmp dword [0x100a103c], edi
mov esi, dword [0xeaf890]
cmp eax, 0xb1111a4e
push ss
adc dl, dl
ljmp 0x6cb7
call fcn.0043b1d0
je 0x479e05
jne 0x479e05
push 0x449c20
push 0x697de5e8
push 0x4063cc
push 0x1026f634
jmp dword [ecx*4 + 0x496090]
Function at 0x490550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491f1b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5976c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x230]
push ecx
push edx
push eax
mov byte [ebp - 4], 1
call fcn.0044a250
add esp, 0xc
cmp eax, edi
je 0x4906f8
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x22c]
je 0x4906f8
lea ecx, [ebp - 0x230]
push 0x4019f0
push ecx
call fcn.0044b5b0
add esp, 8
push 0x4019e0
push 0x4019c8
call dword [0x401188]
push eax
call dword [fcn.004011ac]
cmp eax, edi
je 0x4906f8
push esi
call eax
cmp eax, edi
je 0x49067d
push esi
call dword [0x401068]
test eax, eax
jne 0x49067d
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x21c], dx
call fcn.00481ef0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [0x401064]
test eax, eax
je 0x4906f8
lea edx, [ebp - 0x21c]
push edx
push edi
push edi
mov eax, edx
push eax
call dword [0x401060]
test eax, eax
je 0x4906f8
push 1
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [0x40105c]
test eax, eax
je 0x4906f8
push 0x4019c0
lea edx, [ebp - 0x220]
push esi
push edx
mov dword [ebp - 0x220], edi
call fcn.00483b18
add esp, 0xc
test eax, eax
jne 0x4906f8
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x4906f8
mov ecx, dword [ebp - 0x22c]
push eax
mov eax, dword [ebp - 0x230]
sub ecx, eax
push ecx
push 1
push eax
call fcn.004839e0
mov edx, dword [ebp - 0x220]
push edx
call fcn.0048382d
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp - 0x22c]
sub esi, dword [ebp - 0x230]
push eax
call fcn.0048363e
mov ecx, dword [ebp - 0x220]
xor ebx, ebx
cmp esi, eax
push ecx
sete bl
call fcn.00483436
add esp, 0x1c
mov eax, dword [ebp - 0x230]
cmp eax, edi
je 0x490723
push eax
call fcn.00481d51
add esp, 4
jmp 0x490723
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004819d9
mov esp, ebp
pop ebp
ret
Function at 0x4908b0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491f98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5976c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x490a97
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4908f3
sub eax, edx
sar eax, 1
je 0x490a97
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x490a97
push 0x409
push 0x65
push ebx
call dword [0x401194]
mov esi, eax
cmp esi, ebx
je 0x490a89
push esi
push ebx
call dword [0x4011a0]
mov edi, eax
cmp edi, ebx
je 0x490a97
push esi
push ebx
call dword [0x401198]
cmp eax, ebx
je 0x490a97
push eax
call dword [0x40119c]
cmp eax, ebx
je 0x490a97
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
mov byte [ebp - 4], 1
call fcn.0044a250
add esp, 0xc
cmp eax, ebx
je 0x490a70
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x28]
je 0x490a70
mov edi, dword [ebp + 8]
push 0x4019c0
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 0x18], ebx
call fcn.00483b18
add esp, 0xc
test eax, eax
jne 0x490a70
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x490a70
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
push ecx
sub esi, eax
push esi
push 1
push eax
call fcn.004839e0
mov edx, dword [ebp - 0x18]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.00483436
add esp, 0x14
cmp esi, ebx
je 0x490a70
mov eax, dword [0x5985c0]
mov edx, dword [eax + 0xc]
mov ecx, 0x5985c0
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x6b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0043eed0
cmp eax, ebx
je 0x490a68
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], ebx
je 0x490a68
push edi
lea ecx, [ebp + 8]
call fcn.0043fbd0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0047afe0
push esi
lea ecx, [ebp + 8]
call fcn.00479f60
cmp eax, ebx
je 0x490a60
mov eax, dword [ebp + 8]
push eax
push edi
call dword [0x40106c]
test eax, eax
je 0x490a60
mov ecx, dword [ebp + 8]
push 1
push ebx
push ebx
push ecx
push ebx
push ebx
call dword [0x4011bc]
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 8]
call fcn.00478340
lea ecx, [ebp - 0x1c]
call fcn.0043a480
lea ecx, [ebp - 0x2c]
call fcn.00446d10
jmp 0x490a97
push edi
call dword [0x401068]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40891a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
inc ecx
call fcn.00408938
xor dword [ebx], eax
inc ebx
dec edi
sub edi, 0xddc47111
cmp ebx, edx
jne fcn.0040891a
dec edi
inc ecx
ret
Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4

Function at 0x5d8ab0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x5d87dc
mov ecx, 0xee9d3427
call fcn.005d8ae3
add ebx, ecx
mov ecx, ecx
mov ebx, ebx
xor dword [edi], edx
inc ebx
add edi, 2
sub ebx, ebx
mov ebx, ebx
cmp edi, esi
jl fcn.005d8ab0
dec ecx
sub ebx, 0x8832fe81
ret
Function at 0x4078cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x6f57d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x4078d7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x40791d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x4078fc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40793c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00437460
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x4079cc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x407982
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x407998
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x4079bf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x407971
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x411403
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x41153a
cmp byte [edi + 0x3d], bl
je 0x41153a
call fcn.00403a9d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0040ea4b
pop ecx
pop ecx
test al, al
je 0x411459
xor al, al
jmp 0x41153c
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00405e0c
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.004030bc
mov ecx, eax
call fcn.00403f9b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0040307c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004030bc
mov ecx, eax
call fcn.00403f9b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0040edcf
sub eax, ebx
je 0x4114c1
sub eax, 1
je 0x4114c4
dec eax
sub eax, 1
jne 0x41152d
inc eax
jmp 0x41152b
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.004030bc
mov ecx, eax
call fcn.00403f9b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x411509
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.004030bc
mov ecx, eax
call fcn.00403f9b
push eax
call fcn.0044105c
add esp, 0x10
cmp esi, eax
jne 0x411529
cmp byte [edi + 0x3d], bl
je 0x411527
test esi, esi
jne 0x411468
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00403651
jmp 0x411468
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00402bd8
mov al, bl
jmp 0x41153c
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422b75
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x422ba0
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x422ba0
cmp al, 0xc0
je 0x422ba0
cmp al, 0xcc
je 0x422ba0
add edx, 2
cmp dx, cx
jb 0x422b85
pop esi
ret

Function at 0x42564f
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.004255ec
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x42566a
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x425678
pop edi
pop esi
ret

Function at 0x4278d3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4278eb
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x4278de
pop esi
ret

Function at 0x4278ed
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x427908
shr esi, 2
push esi
call fcn.004278d3
pop ecx
pop esi
ret
test esi, esi
je 0x427919
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x42790e
pop esi
ret

Function at 0x42791b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x42793f
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x42792e
pop edi
pop esi
pop ebx
ret