joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002340b
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x100236e1
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x730bc5de
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x730b35a4
push 0xffffffffffffffff
call fcn.1001a60b
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x10023475
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.1002348d
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x100236d5
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x100236a9
Function at 0x10032edb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10032efd
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10032efd
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10032efd
ret
cmp word [ebx + 4], 0x14c
jne 0x10032efd
test word [ebx + 0x16], 2
je 0x10032efd
test word [ebx + 0x16], 0x100
je 0x10032efd
cmp word [ebx + 0x18], 0x10b
jne 0x10032efd
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10032efd
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10032f89
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10032f1d
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10019e68
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10032efd
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10032f89
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10032efd
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10032efd
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10032efd
ret
cmp word [ebx + 4], 0x14c
jne 0x10032efd
test word [ebx + 0x16], 2
je 0x10032efd
test word [ebx + 0x16], 0x100
je 0x10032efd
cmp word [ebx + 0x18], 0x10b
jne 0x10032efd
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10032efd
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10032f89
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10032f1d
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10019e68
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10032efd
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10033040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10033099
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10033040
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1003304f
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10438cf2
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100330a0
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10019f16
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1003313f
add edi, 4
add eax, 2
dec ecx
jne 0x10033085
call 0x100330ec
loope 0x100330e2
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1003313c
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1003314d
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10033100
cmp eax, ecx
ja 0x10033100
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1003318a
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10033180
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001a3f5
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1003304f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10033099
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10033040
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1003304f
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10438cf2
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100330a0
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10019f16
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1003313f
add edi, 4
add eax, 2
dec ecx
jne 0x10033085
call 0x100330ec
loope 0x100330e2
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1003313c
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1003314d
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10033100
cmp eax, ecx
ja 0x10033100
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1003318a
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10033180
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001a3f5
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42cf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x42cfae
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42cfa5
sub eax, edx
or ebx, 0xffffffff
test eax, eax
je 0x42cfcf
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
xor ebx, dword [edx*4 + 0x90f170]
sub eax, 1
jne 0x42cfb5
not ebx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x42de00
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop word [eax + eax]
xor eax, eax
test cl, 1
je 0x42de1b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x42de26
bts eax, 6
shr ecx, 1
test cl, 1
je 0x42de31
bts eax, 5
shr ecx, 1
test cl, 1
je 0x42de3c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x42de47
bts eax, 3
shr ecx, 1
test cl, 1
je 0x42de52
bts eax, 2
shr ecx, 1
test cl, 1
je 0x42de5d
bts eax, 1
test cl, 2
je 0x42de66
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x42deff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x42def0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x90f170], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x42de10
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4332c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4332ce
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x43338d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
sub edi, 1
jne 0x4332e6
pop edi
test esi, esi
je 0x4333ab
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a28c8]
sub esi, 1
jne 0x433391
not eax
pop esi
pop ebp
ret
Function at 0x4389a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x438a75
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x4389d8
cmp dword [esi + 0x40], ebx
jae 0x4389d8
push ecx
call fcn.004ff256
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x4389dc
test eax, eax
jne 0x4389ee
lea eax, [ebx + ebx]
push eax
call fcn.004ff24d
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.00500630
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x438a72
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x5a31d8]
movzx eax, cl
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
mov dword [esi + 0x30], ecx
mov ecx, edi
xor ecx, 1
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x5a31d8]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x438a02
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x438ab3
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x438a9a
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00500630
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x438ad5
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [0x5a0160]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44d380
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x44d51b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x44d51b
mov ecx, dword [ebx]
test ecx, ecx
je 0x44d51b
add ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, 0x6bca1af3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl ecx, 2
imul ecx
add ecx, 2
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax*2]
push eax
call fcn.00503e6e
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x44d511
push edi
mov edi, dword [ebx]
test edi, edi
jle 0x44d50c
mov ebx, dword [ebp + 8]
mov eax, ebx
not eax
mov dword [ebp - 8], 2
mov dword [ebp - 0x18], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 3]
mov dword [ebp - 0x14], 0xfffffffe
lea edx, [ebx + 2]
sub dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov bl, byte [edx - 2]
mov ecx, dword [ebp - 0x18]
add ecx, edx
mov byte [ebp - 1], bl
xor bl, bl
mov byte [ebp + 0xb], 0
cmp ecx, edi
mov ecx, dword [ebp - 0xc]
jge 0x44d44c
mov bl, byte [edx - 1]
mov byte [ebp + 0xb], bl
xor bl, bl
cmp eax, edi
jge 0x44d44c
mov bl, byte [edx]
mov bh, byte [ebp + 0xb]
mov al, bl
shr al, 6
and bh, 0xf
shl bh, 2
and bl, 0x3f
or bh, al
movzx eax, byte [ebp - 1]
shr eax, 2
movzx eax, byte [eax + 0x6274a0]
mov byte [ecx + esi], al
mov al, byte [ebp - 1]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [ebp + 0xb]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + 0x6274a0]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add ecx, 2
add ecx, esi
add eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
jge 0x44d4b0
movzx eax, bh
mov al, byte [eax + 0x6274a0]
jmp 0x44d4b2
mov al, 0x3d
mov ecx, dword [ebp + 8]
mov byte [ecx], al
cmp dword [ebp - 8], edi
jge 0x44d4c7
movzx eax, bl
mov al, byte [eax + 0x6274a0]
jmp 0x44d4c9
mov al, 0x3d
mov ecx, dword [ebp - 0x20]
mov byte [ecx + esi], al
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x13
mov ecx, dword [ebp - 0xc]
jne 0x44d4ed
mov word [ecx + esi + 4], 0xa0d
add esi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
add edx, 3
mov eax, dword [ebp - 0x14]
add esi, 4
add dword [ebp - 8], 3
add eax, edx
mov edi, dword [ebx]
cmp eax, edi
mov eax, dword [ebp - 8]
jl 0x44d426
mov byte [ecx + esi], 0
pop edi
mov dword [ebx], esi
mov eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478521
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x478534
xor eax, eax
jmp 0x4785d7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x478573
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x4785d5
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004784d1
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4785d3
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4785d7
jmp 0x47856a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x485500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [eax + 4], 0
je 0x48555f
push edi
mov edi, dword [eax + 0x28]
test edi, edi
je 0x48555e
push ebx
call fcn.00485100
xor ebx, ebx
test edi, edi
je 0x48555d
push esi
lea esi, [eax + 1]
nop word [eax + eax]
lea ecx, [edi - 1]
xor edx, edx
mov eax, 0xff
lea esi, [esi + 4]
div ecx
movzx ecx, bl
inc ebx
movzx eax, al
imul eax, ecx
mov byte [esi - 3], al
mov byte [esi - 4], al
mov byte [esi - 5], al
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x28]
cmp ebx, edi
jb 0x485530
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4ad040
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x4ad077
push esi
call fcn.004ad230
add esp, 4
cmp byte [esi + 0x40], 0
je 0x4ad06e
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x4ad082
cmp eax, 0xcb
jne 0x4ad0fe
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x4ad0e8
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x4ad09f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4ad0e2
cmp eax, 2
je 0x4ad0e8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4ad090
cmp eax, 3
je 0x4ad0c7
cmp eax, 1
jne 0x4ad090
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4ad090
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4ad090
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004ad130
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x4ad120
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.004ad130
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x4ad130
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
lea edi, [esi + 0x190]
mov dword [ebp + 8], edi
lea ebx, [esi + 0x78]
je 0x4ad167
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
jmp 0x4ad16a
mov dword [ebp + 8], edi
mov eax, dword [edi]
cmp byte [eax + 8], 0
je 0x4ad1e2
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x4ad1c2
nop dword [eax]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4ad19e
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4ad1f9
cmp eax, dword [esi + 0x60]
jb 0x4ad180
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [edi]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [edi]
cmp byte [eax + 8], 0
jne 0x4ad172
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x4fb910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ebx, [edi + 0x38]
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ecx, dword [edi + 0x74]
add eax, esi
mov edx, dword [edi + 0x6c]
sub ecx, edx
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ecx
cmp edx, eax
jb 0x4fb9bb
mov ecx, dword [ebx]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00500630
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x4fb963
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x4fb990
mov ecx, dword [ebp - 8]
mov edx, dword [edi + 0x6c]
add ecx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x4fbaa7
mov eax, dword [ebp + 8]
push ecx
mov eax, dword [eax]
add eax, dword [edi + 0x74]
add eax, edx
push eax
push ebx
call fcn.004fbd60
mov ebx, dword [edi + 0x74]
add esp, 0xc
add ebx, eax
mov dword [ebp - 8], ebx
mov dword [edi + 0x74], ebx
cmp ebx, 3
jb 0x4fba23
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
movzx edx, byte [eax + ebx]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + ebx + 1]
mov ebx, dword [ebp - 8]
shl edx, cl
xor edx, eax
mov eax, dword [edi + 0x6c]
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 4]
cmp ebx, 0x106
jae 0x4fba3b
jmp 0x4fba28
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4fba38
mov ebx, dword [ebp + 8]
jmp 0x4fb922
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x4fbaa7
add ebx, eax
cmp ecx, ebx
jae 0x4fba79
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
lea eax, [edx + ebx]
push esi
push 0
push eax
call fcn.00500bb0
add esp, 0xc
lea eax, [esi + ebx]
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x4fbaa7
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
lea eax, [ecx + edx]
push esi
push 0
push eax
call fcn.00500bb0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fbdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4fbddc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004fbdf0
Function at 0x4ff8a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x5a0364]
test eax, eax
je 0x4ff8e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ff8e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ff8e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4ff8e2
cmp dword [ecx + 0x74], 0xe
jbe 0x4ff8e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret