joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417eb0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x34]
xor edx, edx
mov eax, 0x40000000
xor ebx, ebx
div esi
mov dword [esp + 0xc], ebx
lea ebp, [ebx + 1]
shl eax, 2
mov dword [esp + 0x10], eax
test eax, eax
je 0x417f47
push edi
push 0x1c
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
imul eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x417f35
mov eax, dword [esp + 0x24]
test eax, eax
je 0x417f35
div esi
cmp dword [esp + 0x28], 0x1000
mov edi, eax
jne 0x417f3e
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x10]
jbe 0x417f3e
push ebp
push eax
push dword [esp + 0x64]
mov dword [esp + 0x1c], eax
call fcn.00417ce0
add esp, 0xc
test al, al
je 0x417f3e
inc ebp
jmp 0x417f3e
mov eax, 0x10000
div esi
mov edi, eax
add ebx, edi
cmp ebx, dword [esp + 0x14]
jb 0x417ee3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret

Function at 0x417ff0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x828
mov eax, dword [0x4a6c44]
xor eax, esp
mov dword [esp + 0x824], eax
cmp byte [0x4a6718], 0
mov eax, dword [esp + 0x82c]
push ebp
push esi
push edi
mov dword [esp + 0xc], eax
je 0x4180ce
push 0x410
lea eax, [esp + 0x14]
mov byte [0x4a6718], 0
push 0
push eax
call fcn.00447100
add esp, 0xc
lea eax, [esp + 0x10]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x418062
push 0x47fb08
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x10]
push eax
call fcn.00417fd0
add esp, 4
mov ebp, eax
lea eax, [esp + 0x420]
push ebp
push eax
call edi
lea eax, [esp + 0x420]
push 0x2e
push eax
call fcn.00419bc0
add esp, 8
test eax, eax
je 0x418097
xor ecx, ecx
mov word [eax], cx
push str.ERRORLOG.TXT
push ebp
call edi
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4180e8
push str.Error_creating_exception_report_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.004440d2
add esp, 0x828
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.00417eb0
push str.ERRORLOG.TXT
push str._r_n__end_of__s___r_n
push esi
call fcn.00419b60
push esi
call fcn.00419b20
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x47fbb4
push ebp
call edi
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41815b
push dword [esp + 0xc]
push esi
call fcn.00417a70
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4180ce
cmp dword [0x4a66fc], 0x51
jne 0x418177
call fcn.004181b0
mov ecx, dword [esp + 0x830]
mov eax, 1
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004440d2
add esp, 0x828
ret
Function at 0x419b60
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x4ad820]
cmp eax, 0x1c00
jle 0x419b96
push 0
lea eax, [esp + 4]
push eax
push 0x4a9820
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x4a9820
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov dword [0x4ad820], eax
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x10]
lea eax, [eax*2 + 0x4a9820]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
add dword [0x4ad820], eax
pop ecx
ret
Function at 0x419cd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc0c
mov eax, dword [0x4a6c44]
xor eax, esp
mov dword [esp + 0xc08], eax
push ebx
mov ebx, dword [esp + 0xc1c]
lea eax, [esp + 0x80c]
push ebp
mov ebp, dword [esp + 0xc1c]
push esi
mov esi, dword [esp + 0xc1c]
push edi
mov edi, dword [esp + 0xc2c]
push 0x200
push eax
push ebp
call fcn.00416610
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 2
push 0
lea eax, [esp + 0x824]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419e55
push 0x200
lea eax, [esp + 0x41c]
push eax
push ebx
call fcn.00416610
push 0x200
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00416610
mov edx, dword [esp + 0xc48]
add esp, 0x18
cmp edx, 4
jne 0x419de4
push edi
call fcn.0044f73e
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
lea eax, [esp + 0x428]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x419e47
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.00470ed0
add esp, 4
push eax
push esi
push str.RegSetValueEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x2b
push str.c:_rhub2codeutility_registryhandler.cpp
push 0
push str.RegistryHandler::AddRegistryValue__
push dword [0x4a9068]
call fcn.0040ee70
add esp, 0x2c
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x419e8c
lea ecx, [esp + 0x18]
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419df0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
push 0
lea eax, [esp + 0x428]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x419e47
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.00470ed0
add esp, 4
push eax
push esi
push str.RegSetValueEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x38
jmp 0x419dbb
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x419e8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
push ebp
push esi
call fcn.00470ed0
add esp, 4
push eax
push esi
push str.RegOpenKeyEx___failed._iErrorCode___d__Error___s__sKey___s__sName___s__sValue___s
push 0x46
push str.c:_rhub2codeutility_registryhandler.cpp
push 0
push str.RegistryHandler::AddRegistryValue__
push dword [0x4a9068]
call fcn.0040ee70
add esp, 0x2c
xor al, al
mov ecx, dword [esp + 0xc18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004440d2
add esp, 0xc0c
ret 0x14
Function at 0x41d230
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret 4

Function at 0x420811
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x420856
call fcn.0041dd7d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x420856
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x420872
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041d3ca
mov ebx, eax
test edi, edi
je 0x420870
test esi, esi
je 0x420870
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x421027
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4210e5
cmp dword [esi + 0x20], 0
je 0x4210e5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4210e5
cmp dword [ebp + 8], 0
je 0x4210e5
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041dd7d
push 0x4814f0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4210b6
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4210e5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042f35b
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4210d6
test edi, edi
je 0x4210d6
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x4210e1
mov ecx, esi
call fcn.00420e05
mov eax, ebx
jmp 0x4210e7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42793b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x42798e
push esi
push dword [ebp + 8]
call fcn.00427b24
mov edi, eax
test edi, edi
je 0x427989
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x427989
mov eax, dword [ebp - 8]
jmp 0x4279a0
mov eax, dword [ebp + 0x10]
jmp 0x4279a0
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x428855
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x42889f
call fcn.0041dd7d
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42889c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4288ef
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x4288cc
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x479760]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x4288cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4288ed
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x479760]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42ab28
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x476fc2
call fcn.0044411a
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42ab4e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42abae
call fcn.004295aa
push eax
lea ecx, [ebp - 0x10]
call fcn.0041d97d
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x479760]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00458d34
push eax
call fcn.00425e94
add esp, 0x14
test esi, esi
je 0x42aba1
push esi
call fcn.00458772
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402dc6
mov eax, ebx
call fcn.004440e3
ret 8
Function at 0x42b3ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x42b3d7
cmp dword [ebx + 0x80], 0
jne 0x42b3d7
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.0041dd7d
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0042b617
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x461434
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004612b1

Function at 0x46143f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4b06d0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x461480
cmp byte [edx], 0xa
jne 0x461480
or byte [eax + edi + 0x28], 4
jmp 0x461485
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x461576
mov al, byte [ebx]
cmp al, 0x1a
je 0x461557
cmp al, 0xd
je 0x4614ae
mov byte [esi], al
inc esi
inc ebx
jmp 0x46154c
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4614ce
cmp byte [eax], 0xa
jne 0x4614c3
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4614c9
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x46154c
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x461545
cmp dword [ebp - 0x14], 0
je 0x461545
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4b06d0]
test byte [eax + edi + 0x28], 0x48
je 0x46151c
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x46150c
mov byte [esi], dl
jmp 0x461548
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4b06d0]
mov byte [eax + edi + 0x2a], dl
jmp 0x461548
cmp byte [ebp - 1], 0xa
jne 0x46152e
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x46152e
mov byte [esi], 0xa
jmp 0x4614cb
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00461f40
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x461549
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x461497
jmp 0x461576
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4b06d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x461571
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x461576
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461581
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4b06d0]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4615c5
cmp word [edx], bx
jne 0x4615c5
or byte [edi + eax + 0x28], 4
jmp 0x4615ca
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x46171e
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4616fe
cmp ax, word [ebp - 0x10]
je 0x461603
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4616f3
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x461629
push 0xa
pop ecx
cmp word [eax], cx
jne 0x461619
push ecx
pop eax
push 4
jmp 0x46161e
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4616ed
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4616e4
cmp dword [ebp - 0x18], 0
je 0x4616e4
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4b06d0]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4616b0
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x461674
mov word [esi], ax
jmp 0x4616a8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4b06d0]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4b06d0]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4b06d0]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4616f3
cmp word [ebp - 4], ax
jne 0x4616c5
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4616c5
mov word [esi], ax
add esi, 2
jmp 0x4616f3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00461f40
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4616f0
jmp 0x4616e7
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4615e3
jmp 0x46171e
mov ecx, dword [ecx*4 + 0x4b06d0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x461715
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x46171e
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46433a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00463fdc

Function at 0x46cab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
mov ebx, dword [edi + 0x6c]
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x34]
add eax, 0xfffffefa
sub edx, dword [edi + 0x64]
add eax, esi
sub edx, ebx
mov dword [ebp - 4], edx
cmp dword [edi + 0x64], eax
jb 0x46cb58
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00446600
mov ebx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea edx, [eax + ebx*2]
nop dword [eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp + 8], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp + 8]
mov word [edx], ax
sub ebx, 1
jne 0x46cb00
mov eax, dword [edi + 0x38]
mov ebx, esi
lea edx, [eax + esi*2]
nop dword [eax + eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp + 8], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp + 8]
mov word [edx], ax
sub ebx, 1
jne 0x46cb30
mov edx, dword [ebp - 4]
add edx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x46cbb0
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
push edx
push eax
push ecx
call fcn.0046cf10
add dword [edi + 0x6c], eax
add esp, 0xc
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x46cb9c
mov eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x46cbb0
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x46cac0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4701a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x4701bc
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4702c1
nop dword [eax + eax]
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x470284
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x4701f6
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x470295
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x470288
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x4701d0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4702d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4702dc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004702f0
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x613e3dd5
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x76884488
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10