joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5181e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x49800d
lea edi, [esi - 0x9700d]
push edi
jmp 0x5181fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x518201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5181f0
mov eax, 1
add ebx, ebx
jne 0x518213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x518224
jne 0x518243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518243
dec eax
add ebx, ebx
jne 0x518230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x518208
add ebx, ebx
jne 0x51823f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x518295
xor ecx, ecx
sub eax, 3
jb 0x51825b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5182ca
sar eax, 1
mov ebp, eax
jmp 0x518266
add ebx, ebx
jne 0x518266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518234
inc ecx
add ebx, ebx
jne 0x518274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518234
add ebx, ebx
jne 0x518281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x518276
jne 0x518292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x518276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5182b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5182a6
jmp 0x5181f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5182b4
add edi, ecx
jmp 0x5181f6
pop esi
mov edi, esi
mov ecx, 0x168f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5182d2
cmp byte [edi], 0x11
jne 0x5182d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5182d7
lea edi, [esi + 0x113000]
mov eax, dword [edi]
or eax, eax
je 0x518346
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130a48]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x130b44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x518304
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x130b4c]
or eax, eax
je 0x518340
mov dword [ebx], eax
add ebx, 4
jmp 0x518321
call dword [esi + 0x130b48]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x518377
cmp al, 0xef
ja 0x51836a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51834c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x518359
mov ebp, dword [esi + 0x130b50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5183ab
sub esp, 0xffffff80
jmp 0x469a3c
Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [0x404008]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionOpenWith
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401191
mov esi, dword [esp + 8]
test esi, esi
je 0x401191
push pe_nt_image_headers32
push eax
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x1c], pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x403224
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401191
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401130
sub ecx, edx
sar ecx, 1
cmp ecx, 0x26
jne 0x401191
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x401191
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x6a283fe2
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4599ecfa
push eax
push 4
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x9e8c491
push eax
mov dword [esp + 0x2c], 0x267b1357
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004012f0
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00401080
mov ebx, eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
push str..pdf
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x401232
mov edi, dword [ebx]
push 4
push esi
push dword [ebp - 4]
mov edi, dword [edi + 0xc]
mov ecx, edi
push ebx
call dword [0x403110]
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x403110]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00401030
int3

Function at 0x4036fc
Capabilities:
Encode data using xor

Disassembly:
pushal
mov ecx, dword [0x4060c6]
mov esi, 0
xor byte [esi + 0x406045], 0x39
inc esi
loop 0x403708
popal
ret
Function at 0x1000aad0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10076610]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x1000aaee
jmp 0x1000abb2
xor eax, eax
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.1004e4c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000ab2c
jmp 0x1000abb2
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
push 4
lea ecx, [ebp - 0x41c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1000aba0
push 0x208
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x41c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000aba0
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10050fe1
add esp, 8
test eax, eax
jne 0x1000aba0
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
jne 0x1000aae3
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004b0b2
mov esp, ebp
pop ebp
ret

Function at 0x1000abc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10076610]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], 0
jne 0x1000abe5
jmp 0x1000ac80
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000abfc
jmp 0x1000ac80
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.1004e4c0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1000ac3c
jmp 0x1000ac80
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.1000aad0
add esp, 8
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1000ac78
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call fcn.1000aad0
add esp, 8
jmp 0x1000ac4f
xor eax, eax
jne 0x1000abda
cmp dword [ebp - 4], 0
je 0x1000ac9d
cmp dword [ebp - 4], 0xffffffff
je 0x1000ac9d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004b0b2
mov esp, ebp
pop ebp
ret
Function at 0x1000e730
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x10076610]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x454], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x1000e766
jmp 0x1000e88e
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.1004e4c0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x1000e879
cmp dword [ebp - 0x230], 0
je 0x1000e85b
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x1000e85b
xor ecx, ecx
mov word [ebp - 0x450], cx
push 0x206
push 0
lea edx, [ebp - 0x44e]
push edx
call fcn.1004e4c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x450]
push eax
push 0
mov ecx, dword [ebp - 0x244]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000e84e
lea ecx, [ebp + 8]
call fcn.1000c760
push eax
lea edx, [ebp - 0x450]
push edx
call fcn.10050fe1
add esp, 8
test eax, eax
jne 0x1000e84e
push 9
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x240], eax
jmp 0x1000e7a9
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
jne 0x1000e749
lea ecx, [ebp + 8]
call fcn.1000c720
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004b0b2
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x1000e8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
push 0x208
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.1004e4c0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 2
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov cx, word [eax]
mov word [ebp - 0x12], cx
add dword [ebp - 0xc], 2
cmp word [ebp - 0x12], 0
jne 0x1000e8db
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x104
jae 0x1000e948
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp - 8]
push ecx
call fcn.1004b0c1
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000e948
mov eax, dword [ebp - 8]
push eax
call fcn.1000b640
add esp, 4
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
call fcn.1000ed50
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x10032d10
Capabilities:
Check http status code

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov ebp, dword [esp + 0xc]
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx]
cmp eax, 2
je 0x10032d4a
push str.Couldnt_set_desired_mode
push edi
call fcn.1001bea0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x10032d61
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edi
call fcn.1001bdc0
add esp, 0xc
cmp ebp, 0x13
jne 0x10032d76
push ebx
call fcn.10032ca0
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x10032d87
call fcn.10030130
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x10032d9a
mov eax, ebx
call fcn.10032cf0
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x10032da8
mov eax, ebx
call fcn.10032d00
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x1003fbe0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1003fc1f
push 4
lea edx, [esp + 4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 8
ret

Function at 0x1004b0b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10076610]
jne 0x1004b0bc
repz ret
jmp fcn.100515de

Function at 0x1004f5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aas
add edx, 0xe8458de6
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
int1
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1004f25d
push eax
push esi
push dword [ebp + 8]
call fcn.1004f212
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1004f25d
push eax
push esi
push dword [ebp + 8]
call fcn.1004f212
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1004f25d
push eax
push esi
push dword [ebp + 8]
call fcn.1004f212
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1004f24d
sti
mov edx, 0x9d88a8ba
jl 0x1004f6d2
invalid
invalid

Function at 0x100513f3
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.1004f24d
adc byte [ebx + 0x21], dl
xlatb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x10051411
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1004f24d
int1
dec edx
pop edi
dec edx
mov edi, eax
mov eax, dword [edi + 0x3c]
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x48]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x40103a
dec al
je 0x4010a7
dec al
je 0x40110e
dec al
je 0x4011bb
jmp 0x401296
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
inc eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
sub edx, eax
jb 0x401296
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x401056
jmp 0x401296
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
test eax, eax
jbe 0x401296
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x48]
xor al, 1
and eax, 0x7f
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0x40]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [eax + eax], al
bsf ecx, ecx
lea ecx, [ecx + esi*4]
lea edi, [ecx*8 + 0x5bb7a8]
mov esi, dword [edi + 4]
mov edx, dword [esi + 4]
mov dword [edi + 4], edx
mov dword [edx], edi
cmp edi, edx
jne 0x401134
mov edx, 0xfffffffe
rol edx, cl
and dword [eax*4 + 0x5bb728], edx
jne 0x401134
btr dword [0x5bb724], eax
mov edi, 0xfffffff0
and edi, dword [esi - 4]
cmp edi, 0x10a60
jb 0x4011b0
mov edx, edi
movzx edi, word [ebx + 0x1a]
sub edx, edi
lea eax, [edi + esi]
lea ecx, [edx + 3]
mov dword [eax - 4], ecx
mov dword [edx + eax - 8], edx
call 0x400db8
jmp 0x4011b5
and byte [edi + esi - 4], 0xf7
lea ecx, [edi + 6]
mov dword [esi - 4], ecx
xor eax, eax
mov byte [0x5bb718], al
mov dword [esi], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 1
mov dword [ebx + 0x10], esi
lea eax, [esi + 0x20]
movzx ecx, word [ebx + 2]
lea edx, [ecx + eax]
mov dword [ebx + 8], edx
add edi, esi
sub edi, ecx
mov dword [ebx + 0xc], edi
mov byte [ebx], 0
mov dword [eax - 4], esi
pop edi
pop esi
pop ebx
ret
sub ecx, ebx
jb 0x4012b4
mov eax, dword [0x5bb71c]
sub eax, ebx
mov dword [0x5bb71c], eax
mov dword [0x5bb720], ecx
or ebx, 2
mov dword [eax - 4], ebx
jmp 0x4012bb
mov eax, ebx
call 0x400e84
mov byte [0x5bb718], 0
pop ebx
ret
Function at 0x42efb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add cl, ch
pop esp
add al, byte [eax]
add byte [ebx + 0x408bfc45], cl
cld
mov eax, dword [eax + 0x24]
inc eax
mov edx, dword [ebp - 4]

Function at 0x42efb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add cl, ch
pop esp
add al, byte [eax]
add byte [ebx + 0x408bfc45], cl
cld
mov eax, dword [eax + 0x24]
inc eax
mov edx, dword [ebp - 4]

Function at 0x42efc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [edx + 0x20]
sub edx, eax
jb 0x42f212
add al, byte [eax]
invalid
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
inc ebp
invalid
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
fmul dword [0x60240d7e]
fsubp st(1)
push dword [ebx + ecx*2]
or bl, ch
sti
pop ss
push esi
cli
mov edx, 0xd2715282
jge 0x42f2a9
jle 0x42f25a
inc edx
inc edx
inc edi
loopne 0x42f1bf
lahf
lahf
lcall 0x5e84, 0x230d713b
and ah, dh
and eax, eax
aam 0xde
jo 0x42f25f
movups xmm0, xmm6
cmp al, 0xe
loop 0x42f212
dec ebx
test eax, 0x1f4badc7
dec ebx
pop ds
or esi, dword [ebp + 0x60]
jno 0x42f264
jns 0x42f24d
inc edi
imul esi, esi, 0x7b01205b
call 0xec234d3d
add dword [ebx - 0x18], edi
fcomp qword [edx - 0x20]
jmp fcn.0042f2af
loopne 0x42f24c
dec ebp
or eax, esi
xor al, 0x12
loop 0x42f22a
adc ah, dl
ret 0x2547
inc edi
and eax, 0x55c05f8a
sahf
mov cl, 0x60
jno 0x42f284
jns 0x42f265
ret
push ebp
push esp
jmp 0x42f2df
jns 0x42f27e
imul ecx, dword [eax + 0x5f8ae1da], 0x2d9655c0
mov eax, 0xf0d95486
retf
stosd dword es:[edi], eax
invalid
or al, 0xeb
pop ebx
xchg esp, eax
int1
test cl, ah
mov word [ebp - 0x55], ss
push ebp
stosd dword es:[edi], eax
iretd

Function at 0x42efd8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
push edx
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
inc eax
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov dh, 0x52
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
xchg ecx, eax
inc eax
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]

Function at 0x42eff8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
push edx
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
inc eax
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov dh, 0x52
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
xchg ecx, eax
inc eax
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]

Function at 0x42f000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]

Function at 0x42f010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
inc dword [ebp - 0x1c]
in al, 0xff
dec ebp
loopne 0x42f092
invalid
jmp 0x42f212
Function at 0x473ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
stosd dword es:[edi], eax
or bh, bl
push esp
add eax, dword [ecx + esi*2 - 0xb]
std
adc dword [ecx], edi
cmpsb byte [esi], byte es:[edi]
add dword [edx - 0x4d1bcfb5], ebx
in al, 0xb2
mov bh, ah
mov ch, 0xd6
loopne 0x473f2d

Function at 0x48bd08
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffd3
mov dl, 0x12
push ecx
push ebp
xor dl, ch
lds edi, [ebx + ecx*4]
push es
out dx, al
invalid

Function at 0x4bb6b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33c0
cmp edx, dword [eax]
je 0x4bb6d3
add eax, 8
inc ecx
cmp eax, 0x4c3450
jl 0x4bb6c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33c0]
jne 0x4bb801
mov eax, dword [0x4c8df0]
cmp eax, 1
je 0x4bb7db
test eax, eax
jne 0x4bb704
cmp dword [0x4c32e8], 1
je 0x4bb7db
cmp edx, 0xfc
je 0x4bb801
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb73b
lea eax, [ebp - 0x1a4]
push 0x4c09b8
push eax
call fcn.004bc090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb77e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09b4
push edi
call fcn.004be3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0998
push eax
call fcn.004bc090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc0a0
lea eax, [ebp - 0xa0]
push 0x4c0994
push eax
call fcn.004bc0a0
push dword [esi + 0x4c33c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc0a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c096c
push eax
call fcn.004be364
add esp, 0x2c
pop edi
jmp 0x4bb801
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33c4]
push 0
push eax
push dword [esi]
call fcn.004bc520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret