joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ece7490
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ece75ac
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x6ece7525
cmp cl, 2
je 0x6ece74cd
cmp cl, 3
jne 0x6ece7595
mov byte [eax + 8], 1
jmp 0x6ece7591
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.6ecec6c0
nop
lea eax, [0x6ee5b398]
mov dword [esp], eax
call fcn.6ecc9b20
nop
mov eax, dword [0x6ee5b364]
sub eax, dword [0x6ee5b348]
mov dword [0x6ee5b364], eax
mov eax, dword [0x6ee5b354]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6ee5b354], ecx
nop
lea eax, [0x6ee5b398]
mov dword [esp], eax
call fcn.6ecc9d20
jmp 0x6ece7591
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.6ecd3880
nop
lea eax, [0x6ee5b398]
mov dword [esp], eax
call fcn.6ecc9b20
nop
mov eax, dword [0x6ee5b33c]
sub eax, dword [0x6ee5b320]
mov dword [0x6ee5b33c], eax
mov eax, dword [0x6ee5b32c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x6ee5b32c], ecx
nop
nop
lea eax, [0x6ee5b398]
mov dword [esp], eax
call fcn.6ecc9d20
add esp, 0x14
ret
lea eax, [0x6edb1873]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.6ecf4a10
nop
call fcn.6ed1d2e0
jmp fcn.6ece7490
Function at 0x6ed0e540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ed0e6c7
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x6ed0e6bd
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x6ed0e59c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x6ed0e59c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x6ed0e5af
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x6ed0e692
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x6ed0e684
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x6ed0e67b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x6ed0e606
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x6ed0e64f
mov eax, 1
cmp eax, ecx
ja 0x6ed0e63d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.6ed1e800
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x6ed0e676
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x6ed0e642
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x6ed0e60b
call fcn.6ed1e7a0
xor eax, eax
mov ecx, eax
call fcn.6ed1e790
call fcn.6ed1e800
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x6ed0e6b8
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x6ed0e689
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x6ed0e5b4
call fcn.6ed1e7a0
xor eax, eax
mov ecx, eax
call fcn.6ed1e790
nop
call fcn.6ed1d2e0
jmp fcn.6ed0e540
Function at 0x6ed12650
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ed12750
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.6ed12ee0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x6ed9e040]
mov dword [esp], ecx
call fcn.6eccbbc0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x6ee5b430]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.6ed11ed0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.6ed112f0
add esp, 0x28
ret
call fcn.6ed1d2e0
jmp fcn.6ed12650
Function at 0x6ed15cc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ed15d5f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.6ed1e8d7
lea ecx, [0x6ed15d70]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.6ed1d1d0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.6ed1d2e0
jmp fcn.6ed15cc0
Function at 0x6ed1e5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6ee77060]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x6ed1cd8b
je 0x6ed1cdde
cmp ebx, 0x20
jbe 0x6ed1cde4
cmp ebx, 0x40
jbe 0x6ed1ce2a
jmp 0x6ed1cecb
test ebx, ebx
je 0x6ed1cdd4
add eax, 0x10
test ax, 0xff0
je 0x6ed1cdc0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6eddc380]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6eddc480]
jmp 0x6ed1cda8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x6ed1cda8
pxor xmm1, xmmword [0x6ee77070]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6ee77070]
pxor xmm2, xmmword [0x6ee77080]
pxor xmm3, xmmword [0x6ee77090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6ee77070]
pxor xmm2, xmmword [0x6ee77080]
pxor xmm3, xmmword [0x6ee77090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x6ed1cf2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x6ee76d4b], 0
je 0x6ed1e5ba
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x6ed1cd50
jmp fcn.6ecc8680
Function at 0x6ed1e5c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ecc2d7e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6ecc8680
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.6ed1d2e0
jmp 0x6ecc2d40
cmp byte [0x6ee76d4b], 0
je 0x6ed1e5db
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x6ed1cd50
jmp 0x6ecc2d40
Function at 0x6ed7c910
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6ed7def0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6ed7def0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6ed7c970
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6ee7b564]
test esi, esi
jle 0x6ed7ca90
mov eax, dword [0x6ee7b568]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6ed7c9a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6ed7ca27
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6ed7c990
mov dword [esp], ebx
call fcn.6ed7d0b0
mov edi, eax
test eax, eax
je 0x6ed7cab7
mov eax, dword [0x6ee7b568]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6ed7d1f0
mov edx, dword [0x6ee7b568]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6ed7ca97
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6ed7ca20
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6ed7ca30
add dword [0x6ee7b564], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6ee7b568]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6ed7ca20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6ed7c910
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6ed7c9ae
mov eax, dword [0x6ee7b568]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6ed7c910
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6ed7c910
lea esi, [esi]
nop
Function at 0x6ed7cd30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6ee7b574
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6ee7b56c]
sub esp, 4
test ebx, ebx
je 0x6ed7cd85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6ed7cd7e
test esi, esi
je 0x6ed7cd7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ed7cd60
mov dword [esp], 0x6ee7b574
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6ed7d0b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6ecc0000], 0x5a4d
jne 0x6ed7d0d5
mov ecx, dword [0x6ecc003c]
cmp dword [ecx + 0x6ecc0000], 0x4550
lea edx, [ecx + 0x6ecc0000]
je 0x6ed7d0e0
ret
cmp word [ecx + 0x6ecc0018], 0x10b
jne 0x6ed7d0d5
push esi
movzx eax, word [ecx + 0x6ecc0014]
push ebx
movzx esi, word [ecx + 0x6ecc0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6ecc0000
test esi, esi
je 0x6ed7d128
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6ed7d11e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6ed7d12a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6ed7d110
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401b10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b54
test esi, esi
je 0x401b54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b30
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401db0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e84
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dee
cmp eax, 4
jne 0x401e10
test esi, esi
je 0x401e02
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401df4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e4f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e41
cmp ecx, 0x40
je 0x401e02
cmp ecx, 4
je 0x401e02
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d60
lea esi, [esi]
Function at 0x403c60
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.004019f0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x403c96
jmp 0x403cde
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403c93
cmp al, 9
je 0x403c93
cmp al, 0x22
jne 0x403cc7
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
je 0x403cb5
test al, al
jne 0x403ca5
cmp al, 0x22
jne 0x403cd3
lea ebx, [edx + 2]
jmp 0x403cd3
cmp al, 9
je 0x403cd3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x403cc0
jmp 0x403cd3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403cd0
cmp al, 9
je 0x403cd0
mov esi, 0xa
test byte [ebp - 0x30], 1
je 0x403ced
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401410
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x463b11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esp + 0x44]
xor ebp, ebp
mov eax, dword [esi + 0x28]
push edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x3f000000
mov ecx, dword [esi + eax*8 + 0xa4d4]
mov dword [esp + 0x28], 0xbf000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0x3f800000
mov edx, dword [esi + eax*8 + 0xa4d8]
mov dword [esp + 0x30], 0xbf800000
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], 0x3fc00000
mov dword [esp + 0x38], 0xbfc00000
mov dword [esp + 0x3c], 0x40000000
mov dword [esp + 0x40], 0xc0000000
shl ebx, 7
mov dword [esp + 0x48], 0
lea edi, [esp + 0x20]
test ebp, ebp
jne 0x463b9c
mov eax, dword [esp + 0x48]
test eax, eax
je 0x463c13
fld dword [esi + 0x3c]
fmul dword [esp + ebp*4 + 0x20]
fld dword [esi + 0x44]
fmul dword [edi]
mov eax, dword [esi + 0x28]
faddp st(1)
fadd dword [esp + 0x10]
fstp dword [esi + eax*8 + 0xa4d4]
fld dword [esi + 0x40]
fmul dword [esp + ebp*4 + 0x20]
fld dword [esi + 0x48]
fmul dword [edi]
mov ecx, dword [esi + 0x28]
faddp st(1)
fadd dword [esp + 0x14]
fstp dword [esi + ecx*8 + 0xa4d8]
mov edx, dword [esi + 0x28]
mov ecx, dword [esi + edx*8 + 0xa4d4]
lea eax, [esi + edx*8]
mov dword [eax + 0xd69c], ecx
mov edx, dword [eax + 0xa4d8]
mov dword [eax + 0xd6a0], edx
mov eax, dword [esi + 0x28]
dec eax
mov ecx, esi
push eax
push 0
push 1
call fcn.004653b1
mov ecx, dword [esi + 0x28]
dec ecx
push ecx
push 0
push 1
mov ecx, esi
call fcn.004654a1
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
push edx
mov ecx, dword [ebx + eax + 0x74]
push ecx
mov ecx, esi
call fcn.00465ba1
mov edx, dword [esi + 0x28]
lea eax, [esp + 0x18]
push eax
push 2
mov ecx, esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], edx
call fcn.00465e31
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x28]
mov edx, dword [ebx + ecx + 0x7c]
mov ecx, esi
push edx
push eax
call fcn.00465f71
mov ecx, dword [esi + 0x1c]
mov edx, dword [ebx + ecx + 0x78]
lea eax, [ebx + ecx]
mov ecx, dword [esi + 0x28]
push edx
mov edx, dword [eax + 0x74]
push ecx
push edx
mov ecx, esi
call fcn.004660f1
test eax, eax
jne 0x463c9f
mov eax, dword [esp + 0x48]
add edi, 4
inc eax
cmp eax, 9
mov dword [esp + 0x48], eax
jl 0x463b90
inc ebp
cmp ebp, 9
jl 0x463b84
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret 4
Function at 0x4665b1
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push ebp
call dword [0x100190b4]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4665e0
mov dword [esi + 0x10508], 1
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov esi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
push edi
mov edi, ebx
mov edx, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
jle 0x4666a7
lea edi, [ebp - 1]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edi
mov al, byte [ebx]
test al, al
je 0x466681
and eax, 0xff
mov esi, ebp
sub esi, edx
mov cl, byte [eax + 0x1001cdf4]
mov byte [esp + 0x14], cl
xor ecx, ecx
test esi, esi
jle 0x46666f
mov edi, dword [esp + 0x14]
and edi, 0xff
mov edx, dword [esi*4 + 0x1001d3c4]
xor eax, eax
mov ebp, 0xff
mov al, byte [edx + ecx]
add eax, edi
cdq
idiv ebp
and edx, ebp
mov al, byte [edx + 0x1001ccf4]
mov dl, byte [ecx + ebx + 1]
xor al, dl
mov byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jl 0x466637
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
cmp esi, edi
jge 0x466693
mov cl, byte [esi + ebx + 1]
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jl 0x466673
jmp 0x466693
xor eax, eax
test edi, edi
jle 0x466693
mov cl, byte [eax + ebx + 1]
mov byte [eax + ebx], cl
inc eax
cmp eax, edi
jl 0x466687
mov eax, dword [esp + 0x10]
dec edi
dec eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], eax
jne 0x46660e
mov ecx, ebp
xor eax, eax
sub ecx, edx
mov esi, 1
test ecx, ecx
pop edi
jle 0x4666c6
cmp byte [eax + ebx], 0
jne 0x4666c4
inc eax
cmp eax, ecx
jl 0x4666b7
jmp 0x4666c6
xor esi, esi
push ebx
call dword [0x100190b0]
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x4666e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
add eax, eax
test eax, eax
mov dword [esp + 4], eax
jle 0x466783
mov edx, 0xfffefd1c
push ebx
push ebp
mov ebp, dword [esp + 0x14]
sub edx, ecx
push esi
push edi
mov dword [esp + 0x24], 0
lea esi, [ecx + 0x102e4]
mov dword [esp + 0x10], edx
xor edi, edi
mov byte [esi], 0
test ebp, ebp
jle 0x46676e
lea ecx, [edx + esi]
lea eax, [ebp - 1]
imul ecx, eax
mov eax, dword [esp + 0x20]
mov al, byte [edi + eax]
test al, al
je 0x46675f
and eax, 0xff
xor edx, edx
mov ebx, 0xff
mov dl, byte [eax + 0x1001cdf4]
mov eax, edx
add eax, ecx
cdq
idiv ebx
and edx, ebx
mov al, byte [edx + 0x1001ccf4]
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
inc edi
add ecx, ebx
cmp edi, ebp
jl 0x466729
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
dec ecx
inc esi
mov dword [esp + 0x24], ecx
lea ecx, [edx + esi]
cmp ecx, eax
jl 0x466717
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc