joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4499f6
Capabilities:
Get common file path
Get disk size
Timestomp file

Disassembly:
mov eax, 0x449bad
call fcn.00430b8c
sub esp, 0x248
mov dword [ebp - 0x14], ecx
add ecx, 0x10
push esi
mov dword [ebp - 0x18], ecx
call fcn.00440520
test byte [ebp + 0xd], 0x10
je 0x449ada
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 8]
call fcn.00441aa0
test eax, eax
je 0x449ada
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.00440440
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call fcn.004415c2
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x34]
push eax
lea edx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push edx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x449a77
mov esi, dword [ebp - 0x34]
imul esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x144]
add eax, eax
cmp eax, esi
jge 0x449ace
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x254]
push eax
push ecx
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ecx, dword [ebp - 0x1c]
push 0x105
mov byte [ecx], 0
mov ecx, dword [ebp - 0x18]
call fcn.00440922
push eax
lea ecx, [ebp - 0x254]
push 0
push 0x457090
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
call fcn.00440977
mov dword [ebp - 4], 0xffffffff
call fcn.00449bb7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
cmp dword [ecx - 8], 0
je 0x449bbf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00440d28
test eax, eax
je 0x449bbf
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.004406e8
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
push eax
lea edx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x14]
push edx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x449b55
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x150]
push eax
push ecx
call fcn.00441b5a
add esp, 8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
push ecx
push edx
push eax
mov ecx, dword [ebp - 0x14]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], eax
push eax
push eax
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
push dword [ebp - 0x10]
call fcn.00440a9c
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x10]
push esi
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
test eax, eax
je 0x449b9d
push esi
mov eax, dword [ebp - 0x18]
push 4
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
push esi
call fcn.00440adc
add esp, 4
mov eax, 1
jmp 0x449bd8
mov ecx, dword [ebp - 0x18]
call fcn.00440520
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.00440d28
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44b046
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, 0x100
cmp edi, eax
ja 0x44b08d
push eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, edi
jne 0x44b08d
push esi
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x44b097
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44ba91
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
cmp dword [ecx + 0x74], 0
mov esi, ecx
je 0x44bad9
push dword [ebp + 8]
call fcn.0045113d
mov esi, eax
test esi, esi
jne 0x44bab3
xor eax, eax
jmp 0x44bb04
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
sbb eax, eax
neg eax
jmp 0x44bb04
push dword [ebp + 0x10]
push 0x456bf4
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x10]
push dword [esi + 0x88]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44d134
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push ebp
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x44d1ca
mov ebp, 0x18000000
push edi
call fcn.00442950
mov ebx, eax
test ebx, ebx
je 0x44d1bb
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x44d1bb
push edi
push eax
call fcn.0044cf88
test eax, eax
je 0x44d1bb
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [esp + 0x14], 0
jne 0x44d1a4
mov ecx, eax
and ecx, ebp
cmp ecx, 0x10000000
jne 0x44d19d
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
or byte [ebx + 0x24], 2
jmp 0x44d1bb
cmp dword [esp + 0x14], 0
je 0x44d1bb
test ebp, eax
jne 0x44d1bb
test byte [ebx + 0x24], 2
je 0x44d1bb
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [ebx + 0x24], 0xfd
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x44d154
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x44fa9b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44fb36
call fcn.00430b8c
sub esp, 4
xor eax, eax
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.CNoTrackObject.0
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov esi, ecx
push 0xa
lea ecx, [esi + 0x30]
call fcn.0043faed
lea ecx, [esi + 0x4c]
push 0xa
mov byte [ebp - 4], 1
call fcn.0043faed
lea ecx, [esi + 0x68]
push 0xa
mov byte [ebp - 4], 2
call fcn.0043f659
mov byte [ebp - 4], 3
mov eax, esi
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x440a80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4509e2
Capabilities:
Allocate thread local storage

Disassembly:
push esi
xor eax, eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], eax
cmp dword [esp + 8], eax
mov dword [ecx + 0x1c], 4
mov dword [ecx + 0xc], 1
mov esi, ecx
je 0x450a1e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x450a24
call fcn.0043ec76
jmp 0x450a24
mov dword [esi], 0xffffffff
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret 4

Function at 0x450b8f
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 0xffffffff
jne 0x450ba9
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
jmp 0x450bb0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x450bc5
mov ecx, dword [esp + 0xc]
cmp dword [eax + 8], ecx
jle 0x450bc5
mov eax, dword [eax + 0xc]
mov edi, dword [eax + ecx*4]
jmp 0x450bc7
xor edi, edi
cmp dword [esi], 0xffffffff
jne 0x450bd6
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x450bdd
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x450cb5
call fcn.00430b8c
sub esp, 4
push ebx
push esi
mov eax, dword [ecx]
push edi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x450c05
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 4]
jmp 0x450c0e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x450c1e
mov edx, dword [ebp + 8]
cmp dword [ebx + 8], edx
jg 0x450d29
cmp dword [ebp + 0xc], 0
je 0x450d35
test ebx, ebx
jne 0x450c9b
push 0x10
call fcn.004509b2
mov dword [ebp - 0x10], eax
mov edi, eax
mov dword [ebp - 4], 0
test edi, edi
je 0x450c63
mov ebx, edi
mov dword [edi], vtable.CNoTrackObject.0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
mov dword [edi], vtable.CThreadData.0
jmp 0x450c65
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
cmp dword [esi], 0xffffffff
jne 0x450c83
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [esi + 0x18]
call fcn.00450952
cmp dword [esi], 0xffffffff
jne 0x450c9b
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0xc]
lea edi, [esi + 0x10]
test eax, eax
jne 0x450cc8
mov eax, dword [edi]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x450cd7
push 2
mov ecx, dword [edi]
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
jne 0x450cf4
cmp dword [esi], 0xffffffff
jne 0x450cef
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0043ec76
mov eax, dword [ebx + 8]
mov ecx, dword [edi]
sub ecx, eax
shl ecx, 2
shl eax, 2
push ecx
push 0
add eax, dword [ebx + 0xc]
push eax
call fcn.00431010
add esp, 0xc
mov ecx, dword [edi]
mov dword [ebx + 8], ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x450d26
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x450d29
mov dword [esi + 4], ebx
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + edx*4], eax
cmp dword [esi], 0xffffffff
jne 0x450d44
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450da5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ecx + 0x20]
push edi
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x450dcc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
jmp 0x450dcf
mov edi, dword [esi + 4]
test edi, edi
je 0x450e87
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [edi + 8], 1
jle 0x450e4a
mov dword [ebp - 0xc], 8
mov ebx, 4
cmp dword [ebp + 8], 0
je 0x450e1e
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, dword [ebp + 8]
cmp dword [edx + ecx + 4], eax
je 0x450e1e
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx], 0
je 0x450e38
mov dword [ebp - 4], 0
jmp 0x450e38
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + ebx]
test ecx, ecx
je 0x450e2e
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [edi + 0xc]
mov dword [eax + ebx], 0
add ebx, 4
inc dword [ebp - 8]
add dword [ebp - 0xc], 8
mov eax, dword [ebp - 8]
cmp dword [edi + 8], eax
jg 0x450df7
cmp dword [ebp - 4], 0
je 0x450e87
push edi
lea ecx, [esi + 0x18]
call fcn.00450965
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x450e6e
push 1
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x450e80
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x450e87
mov dword [esi + 4], 0
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x450e9a
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
cmp dword [ecx], 0
mov esi, ecx
jne 0x450eda
cmp dword [0x468d88], 0
jne 0x450ecd
mov ecx, 0x468d90
test ecx, ecx
je 0x450ec3
push 1
call fcn.004509e2
mov dword [0x468d88], eax
jmp 0x450ecd
mov dword [0x468d88], 0
mov ecx, dword [0x468d88]
call fcn.00450a34
mov dword [esi], eax
mov edi, dword [esi]
mov eax, dword [0x468d88]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x450efa
cmp dword [eax + 8], edi
jle 0x450efa
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x450efc
xor edi, edi
test edi, edi
jne 0x450f14
call dword [esp + 0xc]
push eax
mov edi, eax
push dword [esi]
mov ecx, dword [0x468d88]
call fcn.00450bdd
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x451195
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x468e08
jmp 0x45120c
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx edi, ah
mov dl, al
and eax, 0x80000000
movzx ecx, dl
shl ecx, 8
shr eax, 0x1f
add ecx, edi
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
mov ecx, 1
cmp dl, 4
sbb edx, edx
mov edi, ecx
inc edx
sub edi, edx
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edx
test eax, eax
je 0x45125c
test edx, edx
jne 0x45125c
mov dword [esi + 0x84], ecx
jmp 0x451266
mov dword [esi + 0x84], 0
lea edi, [esi + 0x88]
xor eax, eax
test edx, edx
mov dword [edi], eax
je 0x451285
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
cmp eax, 0x40000
sbb eax, eax
inc eax
mov dword [edi], eax
mov ecx, esi
call fcn.004470b9
push 0xc0c0c0
xor edi, edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x808080
mov dword [esi + 0x20], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov ecx, esi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
call fcn.00446ffc
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
mov dword [esi + 0x58], eax
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], edi
cmp dword [esi + 0x78], 1
sbb eax, eax
mov dword [esi + 0x6c], edi
add eax, 2
pop edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, esi
pop esi
ret
Function at 0x451b29
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x451b5d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
cmp eax, 1
sbb eax, eax
neg eax
jmp 0x451ba9
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x451ba7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x451ba7
mov eax, 1
test esi, esi
je 0x451ba9
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42094b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x420979
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x420997
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004208b5
jmp 0x420997
mov eax, dword [esi + 0x14]
test eax, eax
je 0x420997
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004208b5
test edi, edi
mov eax, edi
jne 0x420981
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x42d864]
test ecx, ecx
je 0x420a4a
jmp 0x42094a
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7ec04051
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x69c457c1
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x41f8a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5c89d0]
xor edx, edx
cmp eax, edx
jne 0x41f8c6
xor eax, eax
mov byte [eax + 0x5c88d0], al
inc eax
cmp eax, 0x100
jl 0x41f8ae
mov dword [0x5c89d0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5c88d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41f957
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41f92a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41f8f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41f9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41fa23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41fa0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x423ee1
cmp eax, 8
jg 0x423ee1
cmp dword [esp + 0x8c], 2
jl 0x423ee1
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x423ee1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x423ee1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x423d47
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x423eca
mov ebp, dword [0x478488]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x423d79
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x423eb1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x423d99
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x478498]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x423dd8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x478494]
lea ecx, [esp + 0x28]
push ecx
call dword [0x478454]
test eax, eax
jne 0x423e98
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004232d0
cmp eax, 1
jne 0x423ec2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00423b80
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x423d8d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x423eca
jmp 0x423d64
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.00422ed0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c