joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x499242
call fcn.0049eee5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x499242
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x499239
xor eax, eax
jmp 0x49924a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00499250
pop edi
pop esi
pop ebx
ret 4

Function at 0x49f415
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49f443
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49f461
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049f37b
jmp 0x49f461
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49f461
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049f37b
test edi, edi
mov eax, edi
jne 0x49f44b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100145c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100145cf
pop dword [ebp - 0x14]
mov eax, 0x2fad7678
add eax, 0xe053cf57
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x387acc97
add dword [ebp - 0x24], 0x15d778b4
mov dword [ebp - 0x20], 0x9600e955
add dword [ebp - 0x20], 0x9c3262f0
mov dword [ebp - 0x1c], 0x456c7915
add dword [ebp - 0x1c], 0x6dfcb19
mov dword [ebp - 0x18], 0x8daaab0e
sub dword [ebp - 0x18], 0x8daaab0e
lea eax, [ebp - 0x24]
push eax
mov eax, 0x59826636
add eax, 0xb681b9fe
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x9674328a
sub dword [ebp - 0x24], 0x2201c934
mov dword [ebp - 0x20], 0xf0d3fafe
sub dword [ebp - 0x20], 0xaf679989
mov dword [ebp - 0x1c], 0xd1700756
add dword [ebp - 0x1c], 0x91ff6516
mov dword [ebp - 0x18], 0x7c92fb28
add dword [ebp - 0x18], 0x836d04d8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xb0badd1f
add eax, 0x5f49432d
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4998a
push 0
call eax
mov ecx, 0x5186
xor edx, edx
add edx, eax
mov esi, 0x10057e00
add esi, dword [ebp - 0x14]
mov ebx, 0x74f0ca60
add ebx, 0x5f847a8
add dword [ebp - 8], 0xe9528f7f
mov edi, dword [esi]
xor dword [ebp - 8], eax
add edi, ebx
add dword [ebp - 4], 0x24a4bf31
mov dword [edx], edi
sub dword [ebp - 8], edx
add edx, 0x72de850d
sub edx, 0x72de8509
add esi, 4
loop 0x100146e7
add eax, 0x5902d0b4
add eax, 0xa6fe6837
xor ebx, ebx
add ebx, eax
add eax, 0xe1f29809
add eax, 0x1e0d67fc
mov ecx, 0xa5983253
add ecx, 0x6a67cdad
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100145c0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.100145c0
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.100145c0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x415d78
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x415d7f
call fcn.0042e5e0
mov dword [0x4b4001], 0x15c
mov dword [0x4b4001], 0x15d
mov byte [esp], 0
mov dword [0x4b4001], 0x15f
lea eax, [esp + 4]
push eax
push 0x28
call fcn.0041916f
push eax
call fcn.004197bd
and eax, eax
je 0x415ebf
mov dword [0x4b4001], 0x160
lea eax, [esp + 8]
mov dword [0x4b4001], 0x162
lea eax, [esp + 8]
push eax
mov eax, str.SeDebugPrivilege
push eax
push 0
call fcn.004197c3
and eax, eax
je 0x415ea2
mov dword [0x4b4001], 0x163
lea eax, [esp + 0x10]
mov dword [0x4b4001], 0x166
lea ebp, [esp + 0x10]
mov dword [ebp], 1
mov dword [0x4b4001], 0x167
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b4001], 0x168
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b4001], 0x169
push ebp
pop ebp
mov dword [ebp + 0xc], 2
mov dword [0x4b4001], 0x16b
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call fcn.004197c9
push eax
pop eax
mov byte [esp], al
mov dword [0x4b4001], 0x16c
mov dword [0x4b4001], 0x16d
push dword [esp + 4]
call fcn.00419127
mov dword [0x4b4001], 0x16e
mov dword [0x4b4001], 0x16f
movsx eax, byte [esp]
movsx eax, al
jmp 0x415ee8
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x426b14
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
add ebp, 0x10
mov dword [esp + 0x10], 5
mov esi, dword [ebp - 8]
mov ecx, esi
mov edx, dword [ebp - 4]
not ecx
and ecx, dword [ebp]
mov eax, edx
mov ebx, dword [ebp - 0x10]
not eax
and eax, dword [ebp + 4]
xor ecx, ebx
mov edi, dword [ebp - 0xc]
xor eax, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp]
mov dword [ebp - 0xc], eax
not ecx
and ecx, dword [ebp + 8]
mov eax, dword [ebp + 4]
xor ecx, esi
not eax
mov dword [ebp - 8], ecx
and eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, edx
mov dword [ebp - 4], eax
not ecx
mov eax, dword [ebp + 0xc]
and ecx, dword [ebp + 0x10]
not eax
and eax, dword [ebp + 0x14]
xor dword [ebp], ecx
lea ebp, [ebp + 0x28]
xor dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
not ecx
and ecx, ebx
not eax
xor dword [ebp - 0x20], ecx
and eax, edi
xor dword [ebp - 0x1c], eax
not ebx
not edi
and ebx, esi
xor dword [ebp - 0x18], ebx
and edi, edx
xor dword [ebp - 0x14], edi
dec dword [esp + 0x10]
jne 0x426b28
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x426d40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x50
push ebx
push ebp
push esi
xor esi, esi
add edx, 0x78
push edi
mov ecx, dword [edx - 0x78]
xor ecx, dword [edx - 0x50]
mov eax, dword [edx - 0x74]
xor eax, dword [edx - 0x4c]
xor ecx, dword [edx - 0x28]
xor eax, dword [edx - 0x24]
xor ecx, dword [edx + 0x28]
xor eax, dword [edx + 0x2c]
xor ecx, dword [edx]
lea edx, [edx + 8]
xor eax, dword [edx - 4]
mov dword [esp + esi*8 + 0x10], ecx
mov dword [esp + esi*8 + 0x14], eax
inc esi
cmp esi, 5
jb 0x426d50
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
shld ecx, eax, 1
mov edi, dword [esp + 0x14]
xor edx, ecx
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add eax, eax
shr esi, 0x1f
xor edx, ebp
xor esi, eax
mov dword [esp + 0x3c], edx
xor esi, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x20]
shld ecx, eax, 1
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x24]
xor edx, ecx
mov ecx, dword [esp + 0x2c]
add eax, eax
xor edx, edi
shr esi, 0x1f
xor esi, eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x28]
xor edx, edx
shld ecx, eax, 1
xor esi, ebx
xor edx, ecx
mov dword [esp + 0x40], esi
xor edx, dword [esp + 0x1c]
add eax, eax
mov esi, dword [esp + 0x2c]
mov ecx, ebp
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x30]
shld ebp, edx, 1
shr ecx, 0x1f
add edx, edx
shr esi, 0x1f
xor ecx, edx
xor esi, eax
xor ecx, dword [esp + 0x20]
xor eax, eax
xor esi, dword [esp + 0x18]
xor eax, ebp
xor eax, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x50], ecx
add edx, 0x50
mov ecx, edi
mov dword [esp + 0x54], eax
shld edi, ebx, 1
shr ecx, 0x1f
xor eax, eax
add ebx, ebx
mov dword [esp + 0x48], esi
xor ecx, ebx
xor eax, edi
xor ecx, dword [esp + 0x28]
xor eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + ebx*8 + 0x38]
mov ecx, dword [esp + ebx*8 + 0x3c]
xor dword [edx - 0x50], eax
xor dword [edx - 0x4c], ecx
xor dword [edx - 0x28], eax
xor dword [edx - 0x24], ecx
xor dword [edx], eax
lea edx, [edx + 8]
xor dword [edx - 4], ecx
xor dword [edx + 0x20], eax
xor dword [edx + 0x24], ecx
xor dword [edx + 0x48], eax
xor dword [edx + 0x4c], ecx
inc ebx
cmp ebx, 5
jb 0x426e54
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x4456c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x445755
mov ecx, dword [esi]
xor eax, eax
push ebx
push ebp
push edi
mov byte [ecx + 0x16], al
xor edi, edi
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x44570b
mov ebp, dword [esi]
movzx edx, byte [edi + ebp]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x4a41b8]
cmp edi, ebx
jl 0x4456f1
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x445731
mov ebp, dword [esi + 8]
movzx edx, byte [edi + ebp]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x4a41b8]
cmp edi, ebx
jl 0x445717
mov ecx, dword [esi]
mov edx, eax
shr edx, 8
pop edi
pop ebp
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
pop ebx
mov byte [ecx + 0x17], dl
mov edx, eax
mov ecx, dword [esi]
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
pop esi
ret

Function at 0x45eae0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x45eb0f
push esi
call fcn.0045ecc0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x45eb08
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x45eb92
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x45eb7d
mov eax, dword [esi + 8]
test eax, eax
je 0x45eb35
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x45eb78
cmp eax, 2
je 0x45eb7d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45eb26
cmp eax, 3
je 0x45eb5d
cmp eax, 1
jne 0x45eb26
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x45eb26
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x45eb26
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0045ebc0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x45ebb4
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0045ebc0
add esp, 4
pop edi
pop esi
ret
Function at 0x45ebc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x45ebec
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
je 0x45ec72
lea ebx, [esi + 0x78]
jmp 0x45ec00
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x45ec46
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45ec25
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x45ec88
cmp eax, dword [esi + 0x60]
jb 0x45ec07
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
jne 0x45ec00
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x463040
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1b8]
mov dword [esp + 0x1c], ebx
jne 0x463065
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x46306b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x463180
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x4630bd
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x463116
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x463100
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x4630e0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x463161
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x463140
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x463140
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x4630a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x48b3e0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [esi]
test bl, bl
je 0x48b491
mov cl, byte [edi]
test cl, cl
je 0x48b491
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b40a
jmp dword [eax*4 + 0x48b4b8]
mov bl, 0x41
jmp case.default.0x48b40a
mov bl, 0x42
jmp case.default.0x48b40a
mov bl, 0x43
jmp case.default.0x48b40a
mov bl, 0x44
jmp case.default.0x48b40a
mov bl, 0x45
jmp case.default.0x48b40a
mov bl, 0x46
jmp case.default.0x48b40a
mov bl, 0x47
jmp case.default.0x48b40a
mov bl, 0x48
jmp case.default.0x48b40a
mov bl, 0x49
jmp case.default.0x48b40a
mov bl, 0x4a
jmp case.default.0x48b40a
mov bl, 0x4b
jmp case.default.0x48b40a
mov bl, 0x4c
jmp case.default.0x48b40a
mov bl, 0x4d
jmp case.default.0x48b40a
mov bl, 0x4e
jmp case.default.0x48b40a
mov bl, 0x4f
jmp case.default.0x48b40a
mov bl, 0x50
jmp case.default.0x48b40a
mov bl, 0x51
jmp case.default.0x48b40a
mov bl, 0x52
jmp case.default.0x48b40a
mov bl, 0x53
jmp case.default.0x48b40a
mov bl, 0x54
jmp case.default.0x48b40a
mov bl, 0x55
jmp case.default.0x48b40a
mov bl, 0x56
jmp case.default.0x48b40a
mov bl, 0x57
jmp case.default.0x48b40a
mov bl, 0x58
jmp case.default.0x48b40a
mov bl, 0x59
jmp case.default.0x48b40a
mov bl, 0x5a
push ecx
call fcn.0048b690
add esp, 4
cmp bl, al
jne 0x48b491
mov bl, byte [esi + 1]
inc esi
inc edi
test bl, bl
jne 0x48b3f5
movzx eax, byte [esi]
push eax
call fcn.0048b690
movzx ecx, byte [edi]
mov bl, al
push ecx
call fcn.0048b690
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x48b520
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [edi]
test bl, bl
je 0x48b5e6
lea ebx, [ebx]
mov cl, byte [ebp]
test cl, cl
je 0x48b5e6
test esi, esi
je 0x48b5ea
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b55e
jmp dword [eax*4 + 0x48b61c]
mov bl, 0x41
jmp case.default.0x48b55e
mov bl, 0x42
jmp case.default.0x48b55e
mov bl, 0x43
jmp case.default.0x48b55e
mov bl, 0x44
jmp case.default.0x48b55e
mov bl, 0x45
jmp case.default.0x48b55e
mov bl, 0x46
jmp case.default.0x48b55e
mov bl, 0x47
jmp case.default.0x48b55e
mov bl, 0x48
jmp case.default.0x48b55e
mov bl, 0x49
jmp case.default.0x48b55e
mov bl, 0x4a
jmp case.default.0x48b55e
mov bl, 0x4b
jmp case.default.0x48b55e
mov bl, 0x4c
jmp case.default.0x48b55e
mov bl, 0x4d
jmp case.default.0x48b55e
mov bl, 0x4e
jmp case.default.0x48b55e
mov bl, 0x4f
jmp case.default.0x48b55e
mov bl, 0x50
jmp case.default.0x48b55e
mov bl, 0x51
jmp case.default.0x48b55e
mov bl, 0x52
jmp case.default.0x48b55e
mov bl, 0x53
jmp case.default.0x48b55e
mov bl, 0x54
jmp case.default.0x48b55e
mov bl, 0x55
jmp case.default.0x48b55e
mov bl, 0x56
jmp case.default.0x48b55e
mov bl, 0x57
jmp case.default.0x48b55e
mov bl, 0x58
jmp case.default.0x48b55e
mov bl, 0x59
jmp case.default.0x48b55e
mov bl, 0x5a
push ecx
call fcn.0048b690
add esp, 4
cmp bl, al
jne 0x48b5e6
mov bl, byte [edi + 1]
inc edi
dec esi
inc ebp
test bl, bl
jne 0x48b540
test esi, esi
jne 0x48b5f4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.0048b690
movzx ecx, byte [ebp]
mov bl, al
push ecx
call fcn.0048b690
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x48b690
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b69f
jmp dword [eax*4 + 0x48b6f8]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x48b760
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x48b80c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
sub edi, edx
lea esp, [esp]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b78d
jmp dword [eax*4 + 0x48b810]
mov cl, 0x41
jmp case.default.0x48b78d
mov cl, 0x42
jmp case.default.0x48b78d
mov cl, 0x43
jmp case.default.0x48b78d
mov cl, 0x44
jmp case.default.0x48b78d
mov cl, 0x45
jmp case.default.0x48b78d
mov cl, 0x46
jmp case.default.0x48b78d
mov cl, 0x47
jmp case.default.0x48b78d
mov cl, 0x48
jmp case.default.0x48b78d
mov cl, 0x49
jmp case.default.0x48b78d
mov cl, 0x4a
jmp case.default.0x48b78d
mov cl, 0x4b
jmp case.default.0x48b78d
mov cl, 0x4c
jmp case.default.0x48b78d
mov cl, 0x4d
jmp case.default.0x48b78d
mov cl, 0x4e
jmp case.default.0x48b78d
mov cl, 0x4f
jmp case.default.0x48b78d
mov cl, 0x50
jmp case.default.0x48b78d
mov cl, 0x51
jmp case.default.0x48b78d
mov cl, 0x52
jmp case.default.0x48b78d
mov cl, 0x53
jmp case.default.0x48b78d
mov cl, 0x54
jmp case.default.0x48b78d
mov cl, 0x55
jmp case.default.0x48b78d
mov cl, 0x56
jmp case.default.0x48b78d
mov cl, 0x57
jmp case.default.0x48b78d
mov cl, 0x58
jmp case.default.0x48b78d
mov cl, 0x59
jmp case.default.0x48b78d
mov cl, 0x5a
mov byte [edi + edx], cl
mov al, byte [edx]
inc edx
test al, al
je 0x48b80b
dec esi
jne 0x48b780
pop edi
pop esi
ret