joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4298ac
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4298c8
cmp dword [esi + 4], 0
je 0x4298f5
test byte [ebx + 0x45], 1
jne 0x4298e7
mov eax, ebx
call fcn.00428850
test eax, eax
jne 0x4298e7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x429a05
mov edx, esi
mov eax, ebx
call fcn.00429524
jmp 0x429a05
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4299fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042b87c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00426814
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004298ac
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042b87c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429a05
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4331a4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403c84
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4331f3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403eb4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43aba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4657e0
cmp dword [edi], 0
jne 0x43ac1c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4657dc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45e918
mov ecx, 2
call fcn.004028d4
mov edx, 0x43ab78
lea eax, [esi + 5]
call fcn.0043ab98
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043ab98
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43abf1
mov dword [0x4657dc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43ad38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43ad88]
test si, 4
je 0x43ad4c
or bl, 1
test si, 8
je 0x43ad56
or bl, 4
test si, 1
je 0x43ad60
or bl, 8
test si, 2
je 0x43ad6a
or bl, 0x10
test si, 0x10
je 0x43ad74
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ad83
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43ad8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43adc4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ada5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43adb4
or bl, 4
test esi, 0x20000000
je 0x43adbf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x440ff4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x441006
add esp, 0xfffffff0
call fcn.0040325c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00415a20
mov eax, ebx
call fcn.00441340
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40ed4c]
call fcn.00402f2c
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40ed4c]
call fcn.00402f2c
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40ed4c]
call fcn.00402f2c
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40ed4c]
call fcn.00402f2c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40ed4c]
call fcn.00402f2c
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x43dae4
push eax
push 0
push 0
mov eax, dword [0x463e54]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x416ee8]
call fcn.004183a8
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x416ee8]
call fcn.004183a8
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x416ee8]
call fcn.004183a8
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.004417b0
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x441684
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x441684
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x441684
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x441115
call fcn.004032b4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x419ae7
Capabilities:
Encode data using xor

Disassembly:
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
add al, byte [edx + 0x49]
jne 0x419ae2
ret

Function at 0x430350
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x430376
fidiv word [esi]
jmp 0x43037d
mov edi, esi
shl edi, 0x11
shr esi, 0xf
or edi, esi
add edi, eax
mov esi, edi
mov edi, dword [edx + 0xc]
add edi, 0xc1bdceee
mov ebp, 0x11e98bc1
fbld tbyte [esi]
out dx, al
xor ebp, ecx
out 0xf3, eax
push es
fisttp word [ebx + 0x16e7c1fb]
mov edi, ebx
shl edi, 0x16
shr ebx, 0xa
or edi, ebx
add edi, esi
mov ebx, edi
mov edi, dword [edx + 0x10]
add edi, 0xf57c0faf
mov ebp, eax
xor al, 0xe5
jmp 0x4303f1
stc
mov eax, edi
mov edi, dword [edx + 0x18]
add edi, 0xa8304613
mov ebp, ebx
xor ebp, ecx
insb byte es:[edi], dx
fbstp tbyte [esi]
jmp 0x430409
mov edi, esi
shl edi, 0x11
shr esi, 0xf
or edi, esi

Function at 0x430392
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x430376
fidiv word [esi]
jmp 0x43037d
mov edi, esi
shl edi, 0x11
shr esi, 0xf
or edi, esi
add edi, eax
mov esi, edi
mov edi, dword [edx + 0xc]
add edi, 0xc1bdceee
mov ebp, 0x11e98bc1
fbld tbyte [esi]
out dx, al
xor ebp, ecx
out 0xf3, eax
push es
fisttp word [ebx + 0x16e7c1fb]
mov edi, ebx
shl edi, 0x16
shr ebx, 0xa
or edi, ebx
add edi, esi
mov ebx, edi
mov edi, dword [edx + 0x10]
add edi, 0xf57c0faf
mov ebp, eax
xor al, 0xe5
jmp 0x4303f1
stc
mov eax, edi
mov edi, dword [edx + 0x18]
add edi, 0xa8304613
mov ebp, ebx
xor ebp, ecx
insb byte es:[edi], dx
fbstp tbyte [esi]
jmp 0x430409
mov edi, esi
shl edi, 0x11
shr esi, 0xf
or edi, esi

Function at 0x4303db
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jp 0x4303e8
add edi, 0x4787c62a
mov ebp, esi
xor ebp, ebx
and ebp, ecx
pop ebx
in eax, 6
std
add eax, edi
mov edi, eax
shl edi, 0xc
shr eax, 0x49
add bh, bl
add edi, ecx

Function at 0x430562
Capabilities:
Authenticate hmac

Disassembly:
clc
mov esi, edi
mov edi, dword [edx + 0x3c]
add edi, 0x49b40821
mov ebp, ecx
mov ch, 0xe0
out dx, al
xor ebp, ecx
mov esi, ebp
push es
fisttp word [ebx + 0x16e7c1fb]
out 0x16, eax
shr ebx, 0xa
or edi, ebx
add edi, esi
mov ebx, edi
mov edi, dword [edx + 4]
add edi, 0xf61e2562
mov ebp, esi
xor ebp, ebx
and ebp, eax
fsubr st(6), st(0)
out 6, al
std
add ecx, edi
mov edi, ecx
shl edi, 5
shr ecx, 0xd1
add edi, esp
add edi, ebx
mov ecx, edi
mov edi, dword [edx + 0x18]
add edi, 0xc040b340
mov ebp, ebx
jmp 0x4305b4
jmp 0xeb79ec73
invalid
mov edi, eax
shl edi, 9
shr eax, 0xf0
add edi, ebx
add edi, ecx

Function at 0x430b2c
Capabilities:
Encode data using xor

Disassembly:
call 0x43e142e
mov edi, dword [edx + 0x18]
add edi, 0xa3014314
mov ebp, ebx
not ebp
or ebp, eax
ja 0x430ae5
push es
std
add esi, edi
mov edi, esi
shl edi, 0xf
out 0xf, eax
shr esi, 0x11
or edi, esi
add edi, eax
mov esi, edi
mov edi, dword [edx + 0x34]
add edi, 0x4e0811a1
mov ebp, ecx
pop edx
aam 0xe
out dx, al
xor ebp, eax
insb byte es:[edi], dx
sti
push es
fisttp word [ebx + 0x15e7c1fb]
shr ebx, 0xb
or ecx, dword [ebx]
sti
invalid
add edi, esi
mov ebx, edi
mov edi, dword [edx + 0x10]
add edi, 0xf7537e82
mov ebp, eax
jge 0x430b14
push cs
jmp 0x430b76
stc
Function at 0x434d22
Capabilities:
Access peb ldr_data

Disassembly:
lea eax, [ebp - 0x10]
mov edx, 5
call 0x467954
pop ecx
test al, al
jne 0x434c15
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00468df2
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [ebp - 0x10]
ja 0x434c34
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00468e11
xor ebx, ebx
jmp 0x468ce4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.0047a42c
test eax, eax
jne 0x434c6c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00468e49
xor ebx, ebx
test byte [ebp - 0xc], 1
je 0x434d75
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.004679df
pop ecx
test al, al
jne 0x434ca0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00468e7d
inc ecx
add eax, dword [eax]
xor ebx, ebx
jmp 0x468d50
mov edx, 0x43193c
mov eax, 0xc
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.004651be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434d79
invalid
movsb byte es:[edi], byte [esi]
and eax, 0xf4e0000
test dword [edi - 2], ebp
invalid
dec esi
jne 0x434bef

Function at 0x44a27a
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
call [eax + 0x1ff0000]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f07001c], al
pop es
dec edi
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x40a0cc
mov al, byte [0xa0ff0000]
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0a001d], al
outsb dx, byte [esi]
inc esp
bound ebp, qword [ebx + eax*2 + 0x6c]
imul esp, dword [ebx + 0x6b], 0x412d04
js 0x44a2a1
add bh, bh
js 0x44a2a5
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
push ds
add byte [edx], cl
dec edi
outsb dx, byte [esi]
inc esp
jb 0x44a31c
inc esp
jb 0x44a32e
jo 0x44a259
sub al, 0x41
add byte [eax - 0x7f010000], al
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0a001f], al
outsb dx, byte [esi]
inc esp
jb 0x44a341
dec edi
jbe 0x44a349
jb 0x44a26e
sub eax, 0x900041
add bh, bh
nop
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f090020], al
outsb dx, byte [esi]
inc ebp
outsb dx, byte [esi]
outsb dx, byte [esi]
add byte [eax - 0x80000000], al
and al, byte [eax]
or ecx, dword [edi + 0x6e]
Function at 0x44fb53
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + edi*8 + 0x44], cl
add byte [eax + eax], cl
add byte [eax], al
les edx, [eax]
inc eax
add byte [esp + ebp + 0x40], al
add al, bh
sub al, byte [eax]
and byte [ebx], ch
inc eax
add byte [ebx + ebp + 0x40], ah
add byte [eax + 0x600044fb], dh
cli
inc esp
add byte [eax - 6], ch
inc esp
add byte [ebx], dl
push esp
inc ebx
jne 0x44fbfc
je 0x44fbfa
insd dword es:[edi], dx
inc esp
arpl word gs:[edi + 0x6d], bp
jo 0x44fc05
jae 0x44fc09
outsd dx, dword [esi]
jb 0x44fb82
cmp al, 0x1c
add byte [eax], al
lea eax, [eax]
jmp 0x4517e1
sub eax, dword fs:[eax]
mov al, 0xfb
inc esp
add al, dh
sti
inc esp
add byte [eax - 4], bl
inc esp
add byte [ebx], dl
push esp
push ebx
je 0x44fc5c
jb 0x44fc54
inc esp
arpl word gs:[edi + 0x6d], bp
jo 0x44fc69
jae 0x44fc6d
outsd dx, dword [esi]
jb 0x44fbfd
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
clc
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, bh
cli
inc esp
add byte [eax + edx], bl
add byte [eax], al
les edx, [eax]
inc eax
add byte [esp + ebp + 0x40], al
add al, bh
sub al, byte [eax]
and byte [ebx], ch
inc eax
add byte [eax + 0x160044fd], dl
push esp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x44fca9
jae 0x44fcad
inc edx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x52], bp
popal
jb 0x44fbd8
push esi
xor esi, esi
mov ecx, 0x48e768
mov eax, esi
mov edx, 8
test al, 1
je 0x44fc64
add byte [eax], al
add byte [eax - 0x2ef68bff], ch
shr eax, 1
pop esi
js 0x330ea1c
call 0xb8cd0bbf
in eax, dx
jmp 0x44fc66
shr eax, 1
jl 0x44fccc
mov dword [ecx], eax
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
rol dword [ecx + eax*4], 0xfe
add byte [ecx], al
add byte [eax], al
jne 0x44fc50
pop esi
ret
mov edx, ebx
and dx, 0xff
loop 0x44fcaa
inc dword [eax]
add byte [ebx], dh
xor ecx, ecx
leave
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x48e768]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x44fca5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
add byte [eax], al
add byte [eax + 0x4b], cl
inc ebp
pop ecx
pop edi
dec esp
dec edi
inc ebx
inc ecx
dec esp
pop edi
dec ebp
inc ecx
inc ebx
dec eax
dec ecx
dec esi
inc ebp
add byte [eax], al

Function at 0x4561fb
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x456271
and byte [ebp + 0x78], ah
imul esi, dword [ebp + 0x64], 0xff00002e
je 0x456269
add byte cs:[eax], al
invalid
invalid
Function at 0x4010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
xor esi, esi
xor ecx, ecx
push edi
test eax, eax
je 0x4012a7
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4012a7
cmp eax, edx
jae 0x4012a7
mov ebx, 0x2f25
mov eax, 0x28c1979
imul ebx
sar edx, 1
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401120
mov esi, 0x736
jmp 0x401140
mov eax, 0x17ad2209
imul esi
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401140
mov edx, 0x28d
mov dword [ebp - 4], 0xe7
mov eax, 0x1d
cmp eax, 0xe7
cmovl eax, dword [ebp - 4]
dec edx
jne 0x401164
xor ecx, ecx
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
jne 0x40118d
add ecx, 2
cmp ecx, 0x9ad
jl 0x401172
xor ecx, ecx
mov edi, 0x6b24
lea esp, [esp]
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 3
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4011a0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov edi, 0x2cc3
mov dword [ebp + 0xc], eax
inc ebx
mov eax, 0x2aaaaaab
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
add edx, edx
mov eax, ebx
sub eax, edx
jne 0x4011de
inc ebx
cmp ebx, 0x20dd
jl 0x4011c3
mov ebx, 0x482b
jmp 0x4011f0
mov eax, 0x88888889
imul ebx
add edx, ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4011f0
xor edx, edx
cmp dword [ebp + 0xc], ecx
jbe 0x401222
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov al, byte [edx + ebx + 1]
add al, 0x20
xor byte [edx + ebx], al
inc edx
cmp edx, esi
jb 0x401212
xor esi, esi
mov edx, 0x7e2d
mov ebx, 0x38
mov eax, 0x86
cmp eax, 0x38
cmovl eax, ebx
dec edx
jne 0x401231
lea ebx, [ebx]
inc esi
mov eax, esi
and eax, 0x80000001
jns 0x40124f
dec eax
or eax, 0xfffffffe
inc eax
jne 0x401252
inc esi
cmp esi, 0x4545
jl 0x401240
lea ebx, [ebx]
mov eax, 0xb81702e1
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401260
inc ecx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
mov eax, ecx
sub eax, edx
jne 0x401296
add ecx, ecx
jmp 0x40129f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, 0x60e9
jl 0x401275
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4026f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, 0xc7
mov ebx, 0x6b52
xor ecx, ecx
mov esi, 0x5183
mov edx, 0x659b
mov dword [ebp - 4], 0xd5
cmp eax, 0xd5
cmovg eax, dword [ebp - 4]
dec edx
jne 0x402716
cmp dword [ebp + 0xc], ecx
je 0x4028f5
jmp 0x402730
mov eax, 0x151d07eb
imul ebx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402730
cmp dword [ebp + 0x10], ecx
jne 0x402751
cmp dword [ebp + 0x18], ecx
je 0x4028f5
mov eax, ecx
and eax, 0x80000001
jns 0x40275f
dec eax
or eax, 0xfffffffe
inc eax
jne 0x402766
add ecx, 3
jmp 0x402767
inc ecx
cmp ecx, 0x2aca
jl 0x402751
mov ecx, dword [ebp + 0xc]
mov edi, 0x6135
mov ebx, dword [ecx + 0x3c]
add ebx, ecx
lea esp, [esp]
mov eax, 0x6bca1af3
imul edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402780
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4028f5
cmp dword [ebx], 0x4550
jne 0x4028f5
mov edx, dword [ebx + 0x7c]
mov dword [ebp - 0x14], edx
mov eax, 0x5fd2
mov dword [ebp - 4], 0x15
mov ecx, 0x5d
cmp ecx, 0x15
cmovl ecx, dword [ebp - 4]
dec eax
jne 0x4027c4
test edx, edx
je 0x4028f5
mov edi, 0x49ef
jmp 0x4027e0
mov eax, 0x6bca1af3
imul edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4027e0
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x78]
add ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x20]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x24]
add eax, edx
mov dword [ebp - 0xc], eax
mov edi, 0x17f6
mov ebx, 0x1053
jmp 0x402820
mov eax, 0x99d722db
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402820
mov eax, dword [ecx + 0x1c]
add eax, dword [ebp + 0xc]
mov ebx, 0x70b7
mov dword [ebp - 0x10], eax
mov eax, 0xa0a0a0a1
imul ebx
add edx, ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402843
mov eax, 0x3be7
mov ebx, 0xcb
mov edx, 0x4e
cmp edx, ebx
cmovl edx, ebx
dec eax
jne 0x402867
mov eax, 0x62c2
mov ebx, 0x65
mov edx, 0xcd
mov edi, edi
cmp edx, ebx
cmovl edx, ebx
dec eax
jne 0x402880
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x10
test eax, eax
je 0x4028f5
xor ebx, ebx
cmp dword [ecx + 0x18], ebx
jbe 0x4028c3
jmp 0x4028a0
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
add eax, dword [ebp + 0xc]
push eax
push edx
call fcn.004032e0
add esp, 8
test eax, eax
jne 0x4028fe
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
inc ebx
cmp ebx, dword [eax + 0x18]
jb 0x4028a0
mov eax, 0x8b70344b
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4028c3
jmp 0x4028e0
mov eax, 0x939a85c5
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4028e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
movzx eax, word [eax + ebx*2]
mov esi, 0x38
mov edx, dword [edx + eax*4]
add edx, dword [ebp + 0xc]
mov eax, 0x5d75
mov ecx, 0xdd
lea ecx, [ecx]
cmp ecx, esi
cmovg ecx, esi
dec eax
jne 0x402920
mov eax, dword [ebp - 4]
cmp edx, eax
jbe 0x402936
add eax, dword [ebp - 0x14]
cmp edx, eax
jb 0x4028f5
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
xor edi, edi
xor esi, esi
lea esp, [esp]
inc edi
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x40317b
inc edi
cmp edi, 0x4545
jl 0x403160
inc esi
mov eax, 0x2aaaaaab
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, esi
sub eax, ecx
jne 0x4031a0
add esi, 5
cmp esi, 0x5d09
jl 0x403183
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], eax
jbe 0x4032d1
mov ecx, dword [ebp + 8]
add ecx, 0xd
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], 0xa2
mov dword [ebp - 0x1c], 0xa
push ebx
mov edi, edi
add eax, dword [ebp + 0xc]
mov ecx, 0x97
mov dword [ebp - 0x20], eax
mov al, byte [eax]
mov dword [ebp - 0x10], 0x70b7
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 2], al
lea edi, [ecx + 0x24]
xor esi, esi
mov dword [ebp - 0x14], 0xfa
mov eax, 0x44d72045
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4031f6
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
inc byte [eax + 0x126]
mov dl, byte [eax + 0x126]
mov eax, 0xda5
cmp ecx, 0xa2
cmovl ecx, dword [ebp - 0x18]
dec eax
jne 0x403220
mov eax, dword [ebp + 8]
movzx edx, dl
add edx, dword [ebp - 8]
movzx eax, byte [eax + 0xb]
movzx ecx, byte [edx]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edx
mov byte [eax + 0xb], cl
mov eax, 0x69b5
lea ecx, [ecx]
cmp edi, 0xa
cmovg edi, dword [ebp - 0x1c]
dec eax
jne 0x403250
movzx edi, cl
add edi, dword [ebp - 8]
push edi
push edx
call fcn.00403670
mov eax, dword [ebp - 0x14]
mov cl, byte [edi]
add esp, 8
add cl, byte [eax]
mov byte [ebp - 1], cl
inc esi
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x40328f
inc esi
cmp esi, 0x4545
jl 0x403274
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, 0x48
mov cl, byte [eax + ecx]
mov eax, 0x659b
jmp 0x4032b0
cmp ebx, edx
cmovg ebx, edx
dec eax
jne 0x4032b0
xor cl, byte [ebp - 2]
mov eax, dword [ebp - 0x20]
mov byte [eax], cl
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x10]
jb 0x4031d0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret