joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ba62
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43ba97
cmp edi, dword [esi + 0xc]
jge 0x43ba97
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43ba97
cmp edi, dword [eax + 8]
jge 0x43ba97
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43ba99
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43bba4
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x43bbd8
jmp fcn.00430d23
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x43bc49
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43bd42
cmp eax, dword [edi + 0xc]
jge 0x43bd42
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x43bc9a
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43bd2b
cmp dword [ebp + 0xc], ebx
je 0x43bd2b
jmp 0x43bcc4
push 0x10
call fcn.0043b92e
cmp eax, ebx
je 0x43bcb0
mov ecx, eax
call fcn.0043bb9b
mov esi, eax
jmp 0x43bcb2
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43bcdb
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43bceb
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43bcfd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00430d23
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00425420
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43bd3d
cmp ecx, dword [esi + 8]
jge 0x43bd3d
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43bd43
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43be01
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43be2f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43be4d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043bd6b
jmp 0x43be4d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43be4d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043bd6b
test edi, edi
mov eax, edi
jne 0x43be37
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x465aec]
test ecx, ecx
je 0x43bf00
jmp 0x43be00
ret 8
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ba010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push ebx
push 6
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0xc], 0x6361722f
mov byte [ebp - 8], bl
mov dword [ebp - 0x14], 0x706d652f
mov word [ebp - 0x10], 0x7974
mov byte [ebp - 0xe], bl
call fcn.0047ec10
add esp, 0x10
test eax, eax
je 0x401058
push ebx
push 6
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.0047ec10
add esp, 0x10
mov dword [ebp - 0x18], ebx
lea ebx, [ebp - 0x1c]
lea edi, [ebp - 0x18]
call fcn.004010b0
mov edi, eax
test edi, edi
jne 0x40107e
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a3bc8
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x18]
lea ebx, [edi + eax + 4]
push eax
call fcn.004011b0
add esp, 4
call dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004a3bc8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x4bac60], 0
push esi
je 0x4064ed
mov eax, dword [0x4bd138]
test eax, eax
je 0x4064bd
push eax
call dword [0x4bacb8]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.00403d10
mov eax, dword [0x4bd138]
test eax, eax
je 0x4064dd
push eax
call dword [0x4bacc0]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4064fc
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x4bac88]
add esp, 4
mov esi, eax
jmp 0x4064e0
cmp dword [0x4bac64], 0
je 0x406543
mov eax, dword [0x4bad68]
test eax, eax
je 0x40651c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x406543
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x406460
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call fcn.004a45ef
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x406553
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x40656c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x41a728
cmp byte [ebx + 9], al
je 0x41a6a1
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], al
jne 0x41a6a1
mov edi, ebx
call fcn.00416c00
mov eax, dword [ebx + 4]
mov edi, dword [eax + 8]
test edi, edi
je 0x41a712
jmp 0x41a6b0
cmp dword [ebp + 0x10], 0
je 0x41a72f
test byte [edi + 0x40], 1
jne 0x41a72f
mov al, byte [edi + 0x42]
cmp al, 1
je 0x41a6cb
cmp al, 2
jne 0x41a79f
cmp al, 2
jne 0x41a6d5
mov byte [edi + 0x42], 1
jmp 0x41a6dc
mov dword [edi + 0x3c], 0
mov esi, edi
call fcn.004170d0
mov esi, eax
test esi, esi
jne 0x41a6f6
push edi
call fcn.00416ff0
add esp, 4
mov byte [edi + 0x42], 3
and byte [edi + 0x40], 0xf1
mov dword [esp + 0xc], esi
test esi, esi
je 0x41a79f
push 0
push esi
push ebx
call fcn.0041a670
add esp, 0xc
cmp byte [ebx + 9], 0
je 0x41a724
dec dword [ebx + 0xc]
jne 0x41a724
mov esi, ebx
call fcn.00416bc0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x30]
test esi, esi
je 0x41a78e
cmp dword [0x4bac60], 0
je 0x41a784
mov eax, dword [0x4bd138]
test eax, eax
je 0x41a752
push eax
call dword [0x4bacb8]
add esp, 4
push esi
call dword [0x4bac94]
sub dword [0x4bcf88], eax
dec dword [0x4bcfac]
add esp, 4
push esi
call dword [0x4bac8c]
mov eax, dword [0x4bd138]
add esp, 4
test eax, eax
je 0x41a78e
push eax
call dword [0x4bacc0]
jmp 0x41a78b
push esi
call dword [0x4bac8c]
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x30], 0
mov byte [edi + 0x42], 4
mov dword [edi + 0x3c], ecx
cmp byte [edi + 0x44], 0
mov dword [esp + 0x10], 0
jl 0x41a859
lea ebx, [edi + 0x78]
mov dword [esp + 0x14], ebx
mov eax, dword [ebx]
test eax, eax
je 0x41a834
mov eax, dword [eax + 0x48]
test byte [eax + 0x18], 0x20
mov esi, dword [eax + 0x10]
je 0x41a811
dec dword [esi + 0x80]
mov edx, dword [esi + 0x90]
mov dword [eax + 0xc], edx
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x90], eax
mov ebx, dword [ecx]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0xa0]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.004a8b20
push edx
mov edx, dword [ebx + 0x48]
push eax
mov eax, dword [esi + 0x40]
push eax
call edx
mov ebx, dword [esp + 0x24]
add esp, 0x10
jmp 0x41a816
call fcn.0040d020
cmp dword [esi + 0x80], 0
jne 0x41a834
mov eax, dword [esi + 0xd8]
cmp dword [eax + 0xc], 0
jne 0x41a834
push esi
call fcn.0040fae0
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [ebx], 0
movsx ecx, byte [edi + 0x44]
inc eax
add ebx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
cmp eax, ecx
jle 0x41a7b8
mov ebx, dword [ebp + 8]
mov edi, dword [edi + 8]
test edi, edi
jne 0x41a6b0
jmp 0x41a712
Function at 0x41b2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov al, byte [esi + 0x42]
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
cmp al, 3
jb 0x41b2d7
cmp al, 4
jne 0x41b2c5
mov eax, dword [esi + 0x3c]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
push eax
call fcn.004040f0
add esp, 4
mov dword [esi + 0x30], ebx
mov byte [esi + 0x42], bl
mov al, byte [esi + 0x44]
test al, al
js 0x41b37f
je 0x41b3c7
jmp 0x41b2f0
movsx ecx, al
mov ecx, dword [esi + ecx*4 + 0x78]
dec al
mov byte [esi + 0x44], al
mov eax, dword [ecx + 0x48]
test byte [eax + 0x18], 0x20
mov edi, dword [eax + 0x10]
je 0x41b34f
dec dword [edi + 0x80]
mov edx, dword [edi + 0x90]
mov dword [eax + 0xc], edx
mov ecx, dword [edi + 0x40]
mov dword [edi + 0x90], eax
mov ebx, dword [ecx]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 0x14]
mov eax, dword [edi + 0xa0]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.004a8b20
push edx
mov edx, dword [ebx + 0x48]
push eax
mov eax, dword [edi + 0x40]
push eax
call edx
mov ebx, dword [esp + 0x1c]
add esp, 0x10
jmp 0x41b354
call fcn.0040d020
cmp dword [edi + 0x80], 0
jne 0x41b372
mov eax, dword [edi + 0xd8]
cmp dword [eax + 0xc], 0
jne 0x41b372
push edi
call fcn.0040fae0
add esp, 4
mov al, byte [esi + 0x44]
test al, al
jne 0x41b2f0
jmp 0x41b3df
mov eax, dword [esi + 0x34]
cmp eax, ebx
jne 0x41b391
mov byte [esi + 0x42], bl
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [esi + 0x41]
mov edx, dword [esi]
mov ebx, dword [edx + 4]
push ecx
lea edi, [esi + 0x78]
push 0
push edi
call fcn.00418660
mov ebx, eax
xor eax, eax
add esp, 0xc
cmp ebx, eax
je 0x41b3bc
mov byte [esi + 0x42], al
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x44], al
mov eax, dword [edi]
mov cl, byte [eax + 2]
mov byte [esi + 0x45], cl
mov eax, dword [esi + 0x78]
cmp byte [eax], 0
je 0x41b44e
movzx eax, byte [eax + 2]
xor edx, edx
cmp dword [esi + 0x48], edx
sete dl
cmp edx, eax
jne 0x41b44e
mov eax, dword [esi + 0x78]
and byte [esi + 0x40], 0xf1
xor ecx, ecx
xor edx, edx
mov word [esi + 0x50], cx
mov word [esi + 0x22], dx
cmp word [eax + 0x16], cx
jbe 0x41b404
mov byte [esi + 0x42], 1
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 8], cl
jne 0x41b443
cmp dword [eax + 4], 1
je 0x41b41f
mov eax, 0xf8a2
call fcn.0047f450
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 9]
mov edx, dword [eax + 0x38]
mov eax, dword [ecx + edx + 8]
bswap eax
push eax
mov eax, esi
mov byte [esi + 0x42], 1
call fcn.0041b230
add esp, 4
mov ebx, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x42], cl
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4b83a0
push 0xf895
push 0x4b8578
push 0x4b855c
push 0xb
call fcn.00406270
add esp, 0x14
pop edi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4284c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov esi, eax
call fcn.0041ad00
movsx edx, byte [esi + 0x44]
mov ecx, dword [ebp + 8]
mov edi, dword [esi + 0x1c]
xor eax, eax
mov word [ebp - 0x20], ax
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + edx*4 + 0x78]
mov eax, dword [eax + 0x3c]
movzx edx, word [esi + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x4284fc
mov eax, edx
cmp edi, eax
ja 0x428513
mov ebx, ecx
mov ecx, 0x1010
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x20], cx
mov dword [ebp - 0x1c], edi
jmp 0x42852c
push 0
push esi
lea esi, [ebp - 0x28]
call fcn.00423400
add esp, 8
test eax, eax
jne 0x4285ed
mov ebx, dword [ebp - 0x18]
mov al, byte [ebx]
cmp al, 0x80
jae 0x428537
movzx edi, al
jmp 0x428544
lea esi, [ebp + 8]
mov ecx, ebx
call fcn.00407d50
mov edi, dword [ebp + 8]
cmp edi, 3
jb 0x4285b3
cmp edi, dword [ebp - 0x1c]
jg 0x4285b3
mov al, byte [edi + ebx - 1]
lea ecx, [edi + ebx - 1]
cmp al, 0x80
jae 0x42855f
movzx edx, al
jmp 0x42856a
lea esi, [ebp + 8]
call fcn.00407d50
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 8
ja 0x4285b3
cmp edx, 7
je 0x4285b3
movzx eax, byte [edx + 0x4b1a08]
mov ecx, dword [ebp - 0x1c]
lea esi, [eax + edi]
cmp ecx, esi
jb 0x4285b3
sub ecx, eax
add ecx, ebx
lea eax, [ebp - 0x50]
call fcn.004272f0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [ebp - 0x28]
call fcn.00422b10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x20], 0x2460
jne 0x4285c2
cmp dword [ebp - 0x10], 0
je 0x4285ca
lea eax, [ebp - 0x28]
call fcn.00422a70
push 0x4b83a0
push 0x1269c
push 0x4b8578
push 0x4b855c
push 0xb
call fcn.00406270
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [eax + 0x28]
push edi
mov eax, esi
call fcn.0041ad00
mov edi, dword [esi + 0x1c]
xor eax, eax
mov ecx, edi
add ecx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x4286bc
jb 0x428635
cmp ecx, 0x7ffffffe
ja 0x4286bc
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [ebp - 0x20], cx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
mov eax, dword [edx + 0x3c]
mov ecx, dword [esi + 0x18]
movzx edx, word [esi + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x42865e
mov eax, edx
cmp edi, eax
ja 0x428673
mov eax, 0x1010
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1c], edi
jmp 0x428685
push 0
push esi
lea esi, [ebp - 0x28]
call fcn.00423400
add esp, 8
test eax, eax
jne 0x4286e5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push 0
push ecx
push edx
push eax
call fcn.00427ba0
add esp, 0x10
test dword [ebp - 0x20], 0x2460
mov dword [ebx], eax
jne 0x4286ac
cmp dword [ebp - 0x10], 0
je 0x4286b4
lea eax, [ebp - 0x28]
call fcn.00422a70
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4b83a0
push 0x126bd
push 0x4b8578
push 0x4b855c
push 0xb
mov dword [ebx], 0
call fcn.00406270
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 8], edx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
jle 0x442ed4
cmp esi, 2
jge 0x442e6a
xor esi, 1
test ebx, ebx
je 0x442f22
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov eax, esi
add eax, eax
mov edi, dword [edx + eax*8]
mov dl, byte [ebx]
mov ecx, ebx
movzx ebx, byte [edi]
movzx ebx, byte [ebx + 0x4b1158]
movzx eax, dl
movzx eax, byte [eax + 0x4b1158]
sub eax, ebx
jne 0x442ec2
sub edi, dword [ebp + 0x10]
mov edi, edi
test dl, dl
je 0x442f1b
movzx eax, byte [edi + ecx + 1]
movzx ebx, byte [eax + 0x4b1158]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x4b1158]
sub eax, ebx
je 0x442ea0
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp - 8]
jl 0x442e62
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
movzx edx, al
movzx edx, byte [edx + 0x4b1158]
sub edx, 0x73
jne 0x442f12
mov edx, 0x4b5780
sub edx, ecx
lea esp, [esp]
test al, al
je 0x442f51
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x4b1158]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x4b1158]
sub edi, esi
je 0x442ef0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x442ec5
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [eax + 0x10]
add esi, esi
mov eax, dword [ecx + esi*8 + 0xc]
push edx
add eax, 8
call fcn.00408620
add esp, 8
test eax, eax
je 0x442ec5
mov eax, dword [eax + 8]
test eax, eax
jne 0x442f14
jmp 0x442ec5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov esi, dword [ecx + 0x10]
test ebx, ebx
jne 0x442f66
neg esi
sbb esi, esi
mov eax, esi
jmp 0x442faa
test esi, esi
je 0x442f12
movzx eax, byte [esi]
movzx edi, byte [eax + 0x4b1158]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x4b1158]
sub eax, edi
mov ecx, ebx
jne 0x442faa
sub esi, ebx
test dl, dl
je 0x442faa
movzx eax, byte [esi + ecx + 1]
movzx edi, byte [eax + 0x4b1158]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x4b1158]
sub eax, edi
je 0x442f88
test eax, eax
jne 0x442f12
mov ecx, 0x4b664c
mov dword [ebp + 0xc], ecx
jmp 0x442e58
Function at 0x443170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ecx + 0x14]
push esi
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], edx
test edx, edx
jle 0x443202
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0xc], eax
push ebx
mov ecx, esi
cmp esi, 2
jge 0x44319c
xor ecx, 1
shl ecx, 4
add ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x44320e
mov esi, dword [ecx]
movzx ecx, byte [esi]
movzx eax, byte [ecx + 0x4b1158]
mov bl, byte [edi]
movzx ecx, bl
movzx ecx, byte [ecx + 0x4b1158]
sub ecx, eax
mov edx, edi
jne 0x4431f2
sub esi, edi
lea esp, [esp]
test bl, bl
je 0x443207
mov bl, byte [edx + 1]
movzx eax, byte [esi + edx + 1]
movzx eax, byte [eax + 0x4b1158]
inc edx
movzx ecx, bl
movzx ecx, byte [ecx + 0x4b1158]
sub ecx, eax
je 0x4431d0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x14]
jl 0x443192
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x4431f2
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x18
call fcn.00408620
add esp, 8
test eax, eax
je 0x443234
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x443201
jmp 0x4431f8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4431f8
Function at 0x4a3bc8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ba010]
jne 0x4a3bd2
repz ret
jmp fcn.004a483b

Function at 0x4a75db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ba010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a55e3
and dword [ebp - 0x14], 0
cmp dword [0x4bcc08], 0
mov dword [ebp - 0x18], eax
jne 0x4a768e
push 0x4aedd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a7736
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4aedc8
push ebx
call edi
test eax, eax
je 0x4a7736
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4aedb8
push ebx
mov dword [0x4bcc08], eax
call edi
push eax
call esi
push 0x4aeda4
push ebx
mov dword [0x4bcc0c], eax
call edi
push eax
call esi
push 0x4aed88
push ebx
mov dword [0x4bcc10], eax
call edi
push eax
call esi
mov dword [0x4bcc18], eax
test eax, eax
je 0x4a768e
push 0x4aed70
push ebx
call edi
push eax
call esi
mov dword [0x4bcc14], eax
mov eax, dword [0x4bcc14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4a76e7
cmp dword [0x4bcc18], ecx
je 0x4a76e7
push eax
call esi
push dword [0x4bcc18]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a76e7
test ebx, ebx
je 0x4a76e7
call edi
test eax, eax
je 0x4a76de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a76de
test byte [ebp - 8], 1
jne 0x4a76e7
or dword [ebp + 0x10], 0x200000
jmp 0x4a771a
mov eax, dword [0x4bcc0c]
cmp eax, dword [ebp - 0x18]
je 0x4a771a
push eax
call esi
test eax, eax
je 0x4a771a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a771a
mov eax, dword [0x4bcc10]
cmp eax, dword [ebp - 0x18]
je 0x4a771a
push eax
call esi
test eax, eax
je 0x4a771a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bcc08]
call esi
test eax, eax
je 0x4a7736
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a7738
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a3bc8
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2cc73b85
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1bcf32f2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219