joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0cf5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x511650]
jne 0x4d0cff
repz ret
jmp fcn.004d64da

Function at 0x4dc483
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004d5cc6
xor ebx, ebx
cmp dword [0x520b28], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4dc558
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4dc4c3
xor eax, eax
jmp 0x4dc61c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x506614
push edi
call esi
cmp eax, ebx
je 0x4dc4bc
push eax
call fcn.004d5c63
mov dword [esp], 0x506604
push edi
mov dword [0x520b28], eax
call esi
push eax
call fcn.004d5c63
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x520b2c], eax
call esi
push eax
call fcn.004d5c63
mov dword [0x520b30], eax
lea eax, [ebp - 8]
push eax
call fcn.004d182f
test eax, eax
pop ecx
pop ecx
je 0x4dc526
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d80b5
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4dc558
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004d5c63
cmp eax, ebx
pop ecx
mov dword [0x520b38], eax
je 0x4dc558
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004d5c63
pop ecx
mov dword [0x520b34], eax
mov eax, dword [0x520b34]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4dc5d1
cmp dword [0x520b38], esi
je 0x4dc5d1
push eax
call fcn.004d5ccf
pop ecx
call eax
cmp eax, ebx
je 0x4dc59e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x520b38]
call fcn.004d5ccf
pop ecx
call eax
test eax, eax
je 0x4dc59e
test byte [ebp - 0x18], 1
jne 0x4dc5d1
lea eax, [ebp - 0xc]
push eax
call fcn.004d1866
test eax, eax
pop ecx
je 0x4dc5b9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d80b5
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4dc5c8
or dword [ebp + 0x10], 0x200000
jmp 0x4dc602
or dword [ebp + 0x10], 0x40000
jmp 0x4dc602
mov eax, dword [0x520b2c]
cmp eax, esi
je 0x4dc602
push eax
call fcn.004d5ccf
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4dc602
mov eax, dword [0x520b30]
cmp eax, esi
je 0x4dc602
push dword [ebp - 4]
push eax
call fcn.004d5ccf
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x520b28]
call fcn.004d5ccf
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100128dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100128ec
pop dword [ebp - 0x10]
mov eax, 0x6a9bda48
add eax, 0xa5654ea4
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x40689
push 0
mov eax, 0xb6be95f1
sub eax, 0xa6b714d5
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x3d67
mov ebx, eax
mov edx, 0x10187200
add edx, dword [ebp - 0x10]
mov edi, 0x5140c708
sub edi, 0x4705cc56
xor dword [ebp - 0xc], edi
mov esi, dword [edx]
sub dword [ebp - 0xc], edi
sub esi, edi
mov dword [ebp - 4], 0x50c7e7ee
mov dword [ebx], esi
sub dword [ebp - 8], 0xa22fbbac
add ebx, 0x63dc690f
sub ebx, 0x63dc690b
add edx, 0x22c01657
sub edx, 0x22c01653
loop 0x1001293f
add eax, 0xe86f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401cb3
pop dword [ebp - 0x24]
mov eax, 0x83423a47
sub eax, 0x83021d94
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x38559
push 0
mov eax, 0x438df08
add eax, 0xfc0801d0
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x61a4be3a
add ecx, 0x9e5b8632
mov edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x24]
mov esi, 0x41ba3e63
sub esi, 0xc2b7c781
xor dword [ebp - 0x20], 0x3f8ea04c
mov edi, dword [ebx]
sub dword [ebp - 0x14], edi
xor edi, esi
xor dword [ebp - 0x14], edx
mov dword [edx], edi
sub dword [ebp - 4], ebx
add edx, 4
add ebx, 0xc222ff9f
add ebx, 0x3ddd0065
loop 0x401d0c
add eax, 0x10483
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3ccdf53a
add ecx, 0xc3720ac6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399
Function at 0x4095d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
push 0x40f96c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40962d
mov ecx, dword [ebp + 8]
push ecx
push str.Error:_No_puedo_abrir_el_fichero__s
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x114]
push eax
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x4096da
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x409684
xor eax, eax
jmp 0x4096da
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x40fb30
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x120]
call fcn.00407960
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4096e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40bbab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
push 0x40fb20
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00408136
mov dword [ebp - 4], 0
push 0x40f994
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x409742
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
jmp 0x40977f
mov edx, dword [ebp - 0x10]
push edx
push 1
lea ecx, [ebp - 0x14]
call fcn.00409a90
push eax
lea ecx, [ebp - 0x14]
call fcn.00405210
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x401110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4012e7
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.004a8e80
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov esi, 0x3b9aca00
xor ebx, ebx
mov ebp, edx
or ebp, ebx
jne 0x4012d2
mul esi
mov esi, eax
mov ebp, edx
mov dword [esp + 0x48], edi
mov eax, edi
cdq
mov ebx, eax
mov ecx, edx
mov eax, esi
mov edx, ebp
add eax, ebx
adc edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00460c60
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], al
lea eax, [esp + 0x50]
xor ebp, ebp
mov dword [eax], ebp
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
xchg ebp, ebx
mov byte [eax + 0x10], bl
xchg ebp, ebx
mov dword [esp + 0x2c], edx
mov dword [eax], edx
mov dword [esp + 0x30], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x28], eax
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov esi, edi
mov dword [esp + 0x3c], edi
xor eax, eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jge 0x40125f
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00461160
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x70]
cmp ebx, ebp
jae 0x4012cb
mov ebp, dword [esp + 0x6c]
add ebp, ebx
movzx ebx, byte [ebp]
mov byte [esp + 0x23], bl
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, eax
inc ebx
cmp ebx, esi
ja 0x40128f
mov edi, ebx
mov dword [esp + 0x38], ebx
mov ebx, ecx
add ebx, eax
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx], al
xchg ebp, eax
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jl 0x4011f6
mov dword [esp], 0
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.004413a0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x78], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x7c], ebx
add esp, 0x64
ret
mov dword [esp], 0x5c5920
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
call fcn.0043d700
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, eax
inc edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ecx
jmp 0x401241
call fcn.00429b10
ud2
imul edx, esi
mov ebp, eax
imul ebp, ebx
add ebp, edx
mov edx, esi
mul edx
add edx, ebp
jmp 0x40116e
call fcn.00452240
jmp fcn.00401110
Function at 0x40b340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b4cb
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40b4be
mov ebp, dword [eax]
cmp ebp, 0
je 0x40b4be
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40b399
mov ebx, 0x5ffc90
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042b7d0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40b41c
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40b3ca
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40b3f0
inc eax
cmp eax, 8
jb 0x40b3ae
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40b3a7
mov ebx, 0x6dc6a0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40b3c4
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40b4ba
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40b3a7
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40b4b6
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40b4b6
mov eax, 1
cmp al, 0
jne 0x40b3a7
mov ecx, edx
jmp 0x40b3a7
xor eax, eax
jmp 0x40b4a6
xor ebx, ebx
jmp 0x40b453
mov ebx, 0x6dc6a0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.00452240
jmp fcn.0040b340
Function at 0x40b4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b67e
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40b66c
mov ebp, dword [eax]
cmp ebp, 0
je 0x40b66c
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40b539
mov ebx, 0x5ffc90
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042b7d0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40b5ca
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40b56e
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40b599
inc eax
cmp eax, 8
jb 0x40b552
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40b54b
mov ebx, 0x6dc6a0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40b568
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40b668
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40b54b
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40b664
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40b664
mov eax, 1
cmp al, 0
jne 0x40b54b
mov ecx, edx
jmp 0x40b54b
xor eax, eax
jmp 0x40b654
xor ebx, ebx
jmp 0x40b601
mov ebx, 0x6dc6a0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.00452240
jmp fcn.0040b4e0
Function at 0x40b690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b822
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40b815
mov ebp, dword [eax]
cmp ebp, 0
je 0x40b815
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40b6e9
mov ebx, 0x5ffc90
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042b7d0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40b773
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x40b721
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x40b71b
cmp esi, dword [esp + 0x18]
je 0x40b747
inc ecx
cmp ecx, 8
jb 0x40b6fe
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x40b6f7
mov ebx, 0x6dc6a0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40b71b
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40b811
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40b6f7
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40b80d
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40b80d
mov eax, 1
cmp al, 0
jne 0x40b6f7
mov edx, ecx
jmp 0x40b6f7
xor eax, eax
jmp 0x40b7fd
xor ebx, ebx
jmp 0x40b7aa
mov ebx, 0x6dc6a0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call fcn.00452240
jmp fcn.0040b690
Function at 0x423720
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423933
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x423817
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call fcn.00414a80
mov ebx, 0x6cdac0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040dde0
mov eax, 0x6cdac0
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x423813
cmp byte [0x6dbe18], 0
jne 0x4237fd
mov dword [edx], ebp
cmp eax, 0
je 0x4237f9
cmp byte [0x6dbe18], 0
jne 0x4237e8
mov dword [eax + 0xc], edx
mov ebx, 0x6cdac0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040e020
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.00410660
jmp 0x4237d0
mov dword [eax], eax
jmp 0x4237c4
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.00410660
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x4237bf
mov dword [edx], eax
jmp 0x4237b4
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x4238d9
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.00424670
mov ebx, 0x6cdac0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040dde0
mov eax, 0x6cdac0
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x4238d5
cmp byte [0x6dbe18], 0
jne 0x4238bf
mov dword [edx], ebp
cmp eax, 0
je 0x4238bb
cmp byte [0x6dbe18], 0
jne 0x4238aa
mov dword [eax + 0xc], edx
mov ebx, 0x6cdac0
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040e020
jmp 0x4237e4
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.00410660
jmp 0x423891
mov dword [eax], eax
jmp 0x423885
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.00410660
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x423880
mov dword [edx], eax
jmp 0x423875
mov ebx, 0x5fa27f
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.0042b7d0
mov ebx, 0x5f8d5b
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x5c5720
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.0040cd80
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call fcn.0042b0f0
ud2
call fcn.00452240
jmp fcn.00423720
Function at 0x424c20
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424d81
sub esp, 0x28
mov ebx, 0x6dbd50
mov dword [esp], ebx
call fcn.0040dde0
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call fcn.0042bfb0
mov ebx, 0x5f8902
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.0042c9c0
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.0042c980
mov ebx, 0x5f7087
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042c9c0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0042c850
mov ebx, 0x5f7085
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042c9c0
call fcn.0042c030
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00449870
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00453ae0
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00453b40
mov edx, dword [esp + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
mov ecx, 0x44e610
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.00452130
call fcn.0042bfb0
mov ebx, 0x5f7066
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042c9c0
call fcn.0042c030
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, 0x6dbd50
mov dword [esp], ebx
call fcn.0040e020
add esp, 0x28
ret
call fcn.00452240
jmp fcn.00424c20
Function at 0x425410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42559c
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x425591
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x425484
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x42546f
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x425588
cmp ecx, 0x20
jae 0x42557d
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call fcn.0044c720
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x42550a
jbe 0x425503
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x425491
cmp edx, 0
jb 0x42550a
jmp 0x4254fc
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x425577
cmp ecx, 0x20
jae 0x42556f
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0044c720
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x425525
xor edx, edx
xor eax, eax
jmp 0x42551b
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x4254ba
xor edx, edx
xor eax, eax
jmp 0x4254ac
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x425465
call fcn.00452240
jmp fcn.00425410