joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000265b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1019e334], 0x23cc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x100026bc
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1000268f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x1000277e
mov dword [0x1019e338], 0x1f12
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1000277e
mov dword [0x1019e334], 0x22b6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000277e
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff6
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x64
jne 0x1000277e
mov dword [0x1019e334], 0x1972
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000277e
mov dword [0x1019e334], 0x11cc
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x6c
jne 0x1000277e
mov eax, 1
mov dword [0x1019e338], 0x20bf
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
je 0x1000278d
xor eax, eax
mov dword [0x1019e334], 0x1c10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret
Function at 0x10002795
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [0x1019e338]
add edx, 0x115d
mov dword [0x1019e334], edx
mov dword [0x1019e338], 0x73c
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x1000288e
lea eax, [0x1018b55c]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x1019e334], 0xa9b
mov dword [0x1019e338], 0x88e
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.10002a3e
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0xc], edx
call fcn.10002dda
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x4f979
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x134e00
mov ecx, dword [ebp - 0x144]
add ecx, 0x4c5fe
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f70
mov dword [0x1019e338], 0xc67
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x110
mov edi, edx
add edi, esi
add edi, 0x50
mov esi, dword [edi]
imul edi, eax, 0x110
add edx, edi
add edx, 0x4c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x112
mov ecx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x1000288e
xor eax, eax
mov dword [0x1019e334], 0x1d3
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1018b57d]
mov dh, byte [eax + 0x1018b54e]
sub dh, dl
mov byte [ebp + eax - 0x12c], dh
cmp ecx, 0xe
mov dword [ebp - 0x14c], ecx
jne 0x100028f9
lea eax, [ebp - 0x12c]
mov dword [0x1019e334], 0x179e
mov dword [ebp - 0x150], eax
call fcn.10001c44
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], eax
call fcn.10002c0b
mov ecx, eax
mov dword [0x1019e354], eax
mov eax, esp
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
lea edx, section..data
imul esi, eax, 0x110
mov edi, edx
add edi, esi
add edi, 0x50
mov esi, dword [edi]
imul edi, eax, 0x110
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x110
add edx, ebx
add edx, 0x4c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], edx
call fcn.1000251e
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x160]
add eax, ecx
mov edx, dword [ebp - 0x15c]
add edx, 1
cmp edx, 0x112
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], edx
je 0x100027db
jmp 0x1000299a
Function at 0x10002a3e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1019e340], 0
mov byte [0x1019e344], 0
mov edi, dword [0x1019e338]
add edi, 0x164c
mov dword [0x1019e338], edi
mov dword [0x1019e334], 0x233d
mov dword [0x1019e33c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], esi
jmp 0x10002b5c
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x1019e348], 0
mov dword [ebp - 0x28], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1019e340]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1019e348], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x1019e340], edx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x1019e344], cl
mov esi, dword [0x1019e338]
add esi, 0xcb7
mov dword [0x1019e334], esi
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov dword [0x1019e334], 0x259f
mov cl, byte [0x1019e344]
mov esi, dword [0x1019e340]
mov byte [ebx + esi], cl
mov esi, dword [0x1019e33c]
add esi, 1
mov dword [0x1019e33c], esi
cmp esi, 0x100
mov dword [ebp - 0x24], esi
jl 0x10002a9d
jmp 0x10002ba1
xor eax, eax
mov dword [0x1019e33c], 0
mov dword [ebp - 0x24], eax
jmp 0x10002a9d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov bl, dl
add ecx, 0x19c7
mov dword [0x1019e334], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x1019e33c]
add eax, 1
mov dword [0x1019e33c], eax
cmp eax, 0x100
mov dword [ebp - 0x2c], eax
jge 0x10002b48
mov eax, dword [0x1019e338]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x10002b5c
mov dword [0x1019e334], 0xf7b
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002dda
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1019e33c], 0
mov dword [0x1019e340], 0
mov dword [0x1019e34c], 0
mov dword [0x1019e334], 0x35f
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10002e41
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1019e33c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019e340], edx
mov dword [0x1019e334], 0x1f88
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1019e344], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1019e334], 0x1a49
mov cl, byte [0x1019e344]
mov edx, dword [0x1019e340]
mov byte [edi + edx], cl
mov dword [0x1019e338], 0x1ac2
mov edx, dword [0x1019e33c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1019e340]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x1019e334]
add edx, 0x11a4
mov dword [0x1019e334], edx
and ebx, 0xff
mov dword [0x1019e34c], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x1019e351]
mov byte [0x1019e350], dl
mov byte [0x1019e351], ch
mov byte [0x1019e352], cl
mov dword [0x1019e338], 0x214e
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x1019e334], 0x20f3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10002e39
mov eax, dword [0x1019e33c]
mov ecx, dword [0x1019e340]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x10002e41

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x40e538
Capabilities:
Execute syscall

Disassembly:
mov edi, 0x38db0455
ret
cwde
salc
mov ss, word [ebp + 0x36]
in al, dx
xchg esp, eax
push ebp
outsd dx, dword [esi]
cmp byte [ecx], ah
jecxz 0x40e523
xor eax, 0xd29f988
mov esi, 0xbe5714a
loop 0x40e4dc
fisub word [ebx + eax - 0x2c]
fldcw word [edi + 0x1748b106]
cli
cwde
js 0x40e4b8
mov ah, 0xb
adc byte [ecx], 0x83
pop ebx
or eax, dword [edx + 0x5bf38311]
loop 0x40e4e1
cmpsd dword [esi], dword es:[edi]
clc
cmp dword [esi], ecx
lcall 0x42ab, 0xf3bb54ef
and dword [edx - 0x6a], 0x28
cmp bl, byte [esi + 0x14]
sbb al, 0x62
dec edx
test al, 0xc4
sar ebx, 0xc1
in al, 0x50
daa
cmpsb byte [esi], byte es:[edi]
cmp edx, dword [esi - 0x5e3b942b]
cld
enter 0x119d, 0xffffffffffffffbc
xchg ecx, eax
inc ebx
lodsd eax, dword [esi]
dec esi
mov cl, 0x6d
fiadd word [esi - 0x58eb13ae]
mov ebx, 0x5c24fd03
sub al, cl
aaa
mov ebx, 0x179cd3fb
dec ebx
bnd jg 0x40e5ba
jge 0x40e580
test eax, 0xe225e0e
into
jge 0x40e5b5
xchg esi, eax
dec eax
adc dh, dh
mov dword [0x3a19f1d2], eax
dec esi
jne 0x40e503
invalid
push ss
dec byte [eax]
out 0xbc, eax
xlatb
adc ebx, ebx
pop ebx
jp 0x40e5fe
mov byte [0x6b04220c], al
add al, 0x6b
int 0x27
aaa
scasb al, byte es:[edi]
mov byte [esi - 0x25b5a6d2], al
daa
dec edx
fisub dword [edi]
lcall 0x411f, 0x648e707a
push esi
push ds
xchg edx, eax
add al, 0xc4
in eax, dx
inc eax
invalid
pop ds
imul eax, dword [ebx + 0x52], 0x30b59ec7
aad 0x49
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x3e3fc242
arpl di, ax
dec ebx
push 0xffffffffffffff98
mov al, byte [0x3055955c]
jle 0x40e5e2
adc eax, 0x35b6882
dec ecx
dec esp
inc edx
std
test byte [ecx + 0xfd5ce7e], dh
sahf
sub esp, dword [ebx - 0x50]
cmpsd dword cs:[esi], dword es:[edi]
arpl word [esi - 0x4f208bb3], si
push ss
jb 0x40e5ea
test bh, dh
cmpsd dword [esi], dword es:[edi]
jl 0x40e664
wait
add dword [ecx - 0x1253582b], ecx
sti
jmp 0x40e690
mov eax, dword [0x460edacc]
xor eax, 0xa61ed178
stosd dword es:[edi], eax
pop esp
retf 0x6a3
pop edx
dec edi
test eax, 0xc08fe669
invalid

Function at 0x40e568
Capabilities:
Execute syscall

Disassembly:
lcall 0xd7bc, 0xe708fe16
cli
sti
lodsd eax, dword [esi]
and esp, esp
push edx
add al, 0x5a
enter 0xffffffffffffe86d, 0xffffffffffffff99
test edx, edi
dec ebx
mov dword [0x5bdb111e], eax
int 0x2e
mov dword [0xaa528ff9], eax
sub edi, dword [ecx]
sar byte [ebx - 0x27], 0xe0
xchg edi, eax
adc eax, 0xb37b85c3
cmp edx, dword [0xab6dcc6a]
or al, 0x60
and dword [edi + 0x494222be], ebx
dec esp
pushfd
lahf
cmp dword [ecx], esi
push ebp
pop esp
fsub st(4)
cmp eax, 0xc67968e5
adc byte [edx + 0xca2477a], cl
and al, byte [ebx + ebp*2]
dec eax
add edi, dword [ebp - 0x1b445053]
ret 0x5641
Function at 0x241ce40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12c0000]
push edi
or ebp, 0xffffffff
jmp 0x241ce62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x241ce69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x241ce58
mov eax, 1
add ebx, ebx
jne 0x241ce7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x241ce8c
jne 0x241ceab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x241ceab
dec eax
add ebx, ebx
jne 0x241ce98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x241ce70
add ebx, ebx
jne 0x241cea7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x241cefd
xor ecx, ecx
sub eax, 3
jb 0x241cec3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x241cf32
sar eax, 1
mov ebp, eax
jmp 0x241cece
add ebx, ebx
jne 0x241cece
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x241ce9c
inc ecx
add ebx, ebx
jne 0x241cedc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x241ce9c
add ebx, ebx
jne 0x241cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x241cede
jne 0x241cefa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x241cede
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x241cf1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x241cf0e
jmp 0x241ce5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x241cf1c
add edi, ecx
jmp 0x241ce5e
pop esi
mov edi, esi
mov ecx, 0x23b78
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x241cf3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x241cf3f
lea edi, [esi + 0x2018000]
mov eax, dword [edi]
or eax, eax
je 0x241cfa7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2036650]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20367d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x241cf65
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20367e0]
or eax, eax
je 0x241cfa1
mov dword [ebx], eax
add ebx, 4
jmp 0x241cf82
call dword [esi + 0x20367dc]
mov ebp, dword [esi + 0x20367e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x241cfdb
sub esp, 0xffffff80
jmp 0xa04534
Function at 0x401ba5
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4213d8
call fcn.00403ecc
mov edi, 0x94
mov eax, edi
call fcn.00404030
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x42116c]
mov ecx, dword [esi + 0x10]
mov dword [0x42b89c], ecx
mov eax, dword [esi + 4]
mov dword [0x42b8a8], eax
mov edx, dword [esi + 8]
mov dword [0x42b8ac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x42b8a0], esi
cmp ecx, 2
je 0x401c05
or esi, 0x8000
mov dword [0x42b8a0], esi
shl eax, 8
add eax, edx
mov dword [0x42b8a4], eax
xor esi, esi
push esi
mov edi, dword [0x4210c0]
call edi
cmp word [eax], 0x5a4d
jne 0x401c40
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c40
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401c58
cmp eax, 0x20b
je 0x401c45
mov dword [ebp - 0x1c], esi
jmp 0x401c6c
cmp dword [ecx + 0x84], 0xe
jbe 0x401c40
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401c66
cmp dword [ecx + 0x74], 0xe
jbe 0x401c40
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00403e7a
pop ecx
test eax, eax
jne 0x401c98
cmp dword [0x42b88c], 1
jne 0x401c85
call fcn.0040362f
push 0x1c
call fcn.004034b8
push 0xff
call fcn.00402fd6
pop ecx
pop ecx
call fcn.00403dd8
mov dword [ebp - 4], esi
call fcn.00403c2d
test eax, eax
jge 0x401cb1
push 0x1b
call fcn.00401b80
pop ecx
call dword [0x421170]
mov dword [0x437854], eax
call fcn.00403b0b
mov dword [0x42b884], eax
call fcn.00403a69
test eax, eax
jge 0x401cd7
push 8
call fcn.00401b80
pop ecx
call fcn.00403836
test eax, eax
jge 0x401ce8
push 9
call fcn.00401b80
pop ecx
push 1
call fcn.00403006
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401cfe
push eax
call fcn.00401b80
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x421174]
call fcn.004037d9
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x401d1f
movzx eax, word [ebp - 0x40]
jmp 0x401d22
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041ef81
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401d40
push edi
call fcn.00403131
call fcn.00403153
jmp 0x401d72
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00403f07
ret
Function at 0x405fee
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40601c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x406023
cmp ebx, dword [eax + 4]
jae 0x406023
xor eax, eax
jmp 0x406213
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x406034
xor eax, eax
inc eax
jmp 0x406212
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40604a
cmp ecx, edx
jae 0x40618f
cmp dword [eax + 4], 0
je 0x406053
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40603b
cmp dword [ebp + 8], 0
je 0x406075
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40618f
cmp eax, esi
jae 0x40618f
mov eax, dword [0x42ba40]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40609a
cmp dword [esi*4 + 0x42ba48], edi
je 0x406193
inc esi
cmp esi, eax
jl 0x406088
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4210f4]
test eax, eax
je 0x40620f
cmp dword [ebp - 8], 0x1000000
jne 0x40620f
test byte [ebp - 0xc], 0xcc
je 0x406118
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40620f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40620f
cmp word [eax + 0x18], 0x10b
jne 0x40620f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40620f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x406118
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x406118
test byte [ecx + 0x27], 0x80
jne 0x40618f
push 1
push 0x42ba88
call dword [0x4210f8]
test eax, eax
jne 0x40602c
mov ecx, dword [0x42ba40]
test ecx, ecx
mov edx, ecx
jle 0x40614c
lea eax, [ecx*4 + 0x42ba44]
cmp dword [eax], edi
je 0x40614c
dec edx
sub eax, 4
test edx, edx
jg 0x406140
test edx, edx
jne 0x40617d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x406159
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x406171
lea eax, [edx*4 + 0x42ba48]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40615f
cmp ecx, 0x10
jge 0x40617d
inc ecx
mov dword [0x42ba40], ecx
push 0
push 0x42ba88
call dword [0x4210f8]
jmp 0x40602c
xor eax, eax
jmp 0x406212
test esi, esi
jle 0x40602c
mov ebx, dword [0x4210f8]
push 1
push 0x42ba88
call ebx
test eax, eax
jne 0x40602c
cmp dword [esi*4 + 0x42ba48], edi
je 0x4061e9
mov eax, dword [0x42ba40]
lea esi, [eax - 1]
test esi, esi
jl 0x4061d7
cmp dword [esi*4 + 0x42ba48], edi
je 0x4061d3
dec esi
jns 0x4061c7
test esi, esi
jge 0x4061e7
cmp eax, 0x10
jge 0x4061e2
inc eax
mov dword [0x42ba40], eax
lea esi, [eax - 1]
jmp 0x4061e9
je 0x406201
xor ecx, ecx
test esi, esi
jl 0x406201
lea eax, [ecx*4 + 0x42ba48]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4061ef
push 0
push 0x42ba88
call ebx
jmp 0x40602c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419858
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
mov ecx, dword [edi + 0x40]
mov ebx, eax
mov eax, dword [esi + 4]
sub eax, dword [ebp + 8]
cmp eax, ecx
mov edx, eax
jl 0x41987c
mov edx, ecx
cmp edx, dword [ebp + 0x10]
jge 0x41988a
cmp eax, ecx
jl 0x41988d
mov dword [ebp - 4], ecx
jmp 0x419890
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov esi, dword [esi + 8]
sub esi, dword [ebp + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp esi, eax
mov edx, esi
jl 0x4198a6
mov edx, eax
cmp edx, ebx
jge 0x4198b8
cmp esi, eax
jge 0x4198b3
mov dword [ebp + 0x10], esi
jmp 0x4198bb
mov dword [ebp + 0x10], eax
jmp 0x4198bb
mov dword [ebp + 0x10], ebx
cmp dword [ebp - 4], 0
je 0x4199e8
cmp dword [ebp + 0x10], 0
je 0x4199e8
lea eax, [ecx*8 + 0x1f]
and eax, 0xffffffe0
cdq
push 8
pop ecx
idiv ecx
mov esi, dword [edi + 4]
mov ebx, dword [esi + 4]
shl ebx, 5
add ebx, 0x1f
shr ebx, 5
shl ebx, 5
shr ebx, 3
mov ecx, ebx
imul ecx, dword [ebp + 0xc]
add ecx, dword [esi + 0x18]
mov esi, 0xff
shl eax, 3
sar eax, 3
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x464]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
movzx eax, al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
shr eax, 8
movzx eax, al
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp + 0x14]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp + 0x14], eax
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov edi, esi
div edi
mov edx, dword [ebp + 0x14]
mov byte [ebp + edx*4 - 0x41e], al
mov eax, dword [ebp + 0xc]
xor edx, edx
div edi
mov edx, dword [ebp + 0x14]
mov byte [ebp + edx*4 - 0x41f], al
mov eax, dword [ebp - 8]
xor edx, edx
div edi
mov edx, dword [ebp + 0x14]
inc dword [ebp + 0x14]
mov byte [ebp + edx*4 - 0x420], al
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], edx
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
add dword [ebp - 8], edx
cmp dword [ebp + 0x14], 0x100
mov dword [ebp - 0xc], eax
jb 0x419941
mov eax, dword [ebp + 0x10]
test eax, eax
jbe 0x4199e8
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
lea ecx, [ecx + edx*4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
mov esi, ecx
mov dword [ebp + 0x14], edi
jbe 0x4199de
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [eax]
inc dword [ebp + 0x14]
lea eax, [ebp + eax*4 - 0x420]
mov dl, byte [eax]
mov byte [esi], dl
mov dl, byte [eax + 1]
mov al, byte [eax + 2]
mov byte [esi + 1], dl
mov byte [esi + 2], al
add esi, 4
dec dword [ebp + 0x10]
jne 0x4199b6
add edi, dword [ebp - 0x1c]
add ecx, ebx
dec dword [ebp + 0xc]
jne 0x4199a7
pop edi
pop esi
pop ebx
leave
ret 0x10