joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b020
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x13c]
sub eax, esi
sub eax, 0x38
cdq
add dword [esi + 0x140], eax
lea ebx, [esi + 0x38]
push edi
adc dword [esi + 0x144], edx
mov edx, dword [esi + 0x28]
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x138], ebx
test edx, edx
je 0x46b0b4
mov ecx, dword [esi + 0x30]
add ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x34]
adc eax, dword [esi + 0x24]
cmp dword [esi + 0x144], eax
jl 0x46b077
jg 0x46b071
cmp dword [esi + 0x140], ecx
jb 0x46b077
pop edi
pop esi
xor eax, eax
pop ebx
ret
test edx, edx
je 0x46b0b4
mov edi, dword [esi + 0x20]
add edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x24]
adc ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x140]
mov eax, dword [esi + 0x144]
add edx, 0x100
adc eax, 0
cmp eax, ecx
jl 0x46b0b4
jg 0x46b0a6
cmp edx, edi
jbe 0x46b0b4
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x140]
add eax, dword [esi + 0x30]
jmp 0x46b0b9
mov eax, 0x100
mov ecx, dword [esi + 0x18]
push ecx
push eax
push 1
push ebx
call fcn.00514432
lea eax, [eax + esi + 0x38]
add esp, 0x10
cmp dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret

Function at 0x46b021
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x13c]
sub eax, esi
sub eax, 0x38
cdq
add dword [esi + 0x140], eax
lea ebx, [esi + 0x38]
push edi
adc dword [esi + 0x144], edx
mov edx, dword [esi + 0x28]
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x138], ebx
test edx, edx
je 0x46b0b4
mov ecx, dword [esi + 0x30]
add ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x34]
adc eax, dword [esi + 0x24]
cmp dword [esi + 0x144], eax
jl 0x46b077
jg 0x46b071
cmp dword [esi + 0x140], ecx
jb 0x46b077
pop edi
pop esi
xor eax, eax
pop ebx
ret
test edx, edx
je 0x46b0b4
mov edi, dword [esi + 0x20]
add edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x24]
adc ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x140]
mov eax, dword [esi + 0x144]
add edx, 0x100
adc eax, 0
cmp eax, ecx
jl 0x46b0b4
jg 0x46b0a6
cmp edx, edi
jbe 0x46b0b4
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x140]
add eax, dword [esi + 0x30]
jmp 0x46b0b9
mov eax, 0x100
mov ecx, dword [esi + 0x18]
push ecx
push eax
push 1
push ebx
call fcn.00514432
lea eax, [eax + esi + 0x38]
add esp, 0x10
cmp dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret
Function at 0x46bbf0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52b8b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
mov ecx, 1
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
xor edi, edi
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CCITTFaxStream.0
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], eax
cmp eax, ecx
jge 0x46bc59
mov dword [esi + 0x18], ecx
jmp 0x46bc67
cmp eax, 0x7ffffffd
jle 0x46bc67
mov dword [esi + 0x18], 0x7ffffffd
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x20], edx
mov edx, dword [esi + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x3c]
add edx, ecx
push 4
push edx
mov dword [esi + 0x24], eax
call fcn.004a30a0
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x18]
add eax, 2
push 4
push eax
call fcn.004a30a0
mov edx, dword [esi + 0x3c]
xor ecx, ecx
add esp, 0x10
cmp dword [esi + 0xc], edi
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x18]
setl cl
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x2c], ecx
mov dword [edx], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x20
Function at 0x46dec3
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp dword [esp + 0x10], ebp
jle 0x46dfd3
push ebx
push edi
mov ecx, dword [esi + 0x138]
mov eax, dword [esi + 0x13c]
cmp ecx, eax
jb 0x46df9a
mov ecx, dword [esi + 0x28]
sub eax, esi
sub eax, 0x38
cdq
add dword [esi + 0x140], eax
lea ebx, [esi + 0x38]
mov dword [esi + 0x13c], ebx
adc dword [esi + 0x144], edx
mov dword [esi + 0x138], ebx
test ecx, ecx
je 0x46df71
mov edx, dword [esi + 0x30]
add edx, dword [esi + 0x20]
mov eax, dword [esi + 0x34]
adc eax, dword [esi + 0x24]
cmp dword [esi + 0x144], eax
jg 0x46dfd1
jl 0x46df34
cmp dword [esi + 0x140], edx
jae 0x46dfd1
test ecx, ecx
je 0x46df71
mov edi, dword [esi + 0x20]
add edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x24]
adc ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x140]
mov eax, dword [esi + 0x144]
add edx, 0x100
adc eax, 0
cmp eax, ecx
jl 0x46df71
jg 0x46df63
cmp edx, edi
jbe 0x46df71
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x140]
add eax, dword [esi + 0x30]
jmp 0x46df76
mov eax, 0x100
mov ecx, dword [esi + 0x18]
push ecx
push eax
push 1
push ebx
call fcn.00514432
mov ecx, dword [esi + 0x138]
lea eax, [eax + esi + 0x38]
add esp, 0x10
mov dword [esi + 0x13c], eax
cmp ecx, eax
jae 0x46dfd1
mov ebx, dword [esp + 0x18]
mov edi, dword [esi + 0x13c]
mov eax, ebx
sub edi, ecx
sub eax, ebp
cmp edi, eax
jle 0x46dfb0
mov edi, eax
mov eax, dword [esp + 0x14]
push edi
push ecx
add eax, ebp
push eax
call fcn.00511be0
add dword [esi + 0x138], edi
add ebp, edi
add esp, 0xc
cmp ebp, ebx
jl 0x46ded2
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret 8
Function at 0x47d1a0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [ecx + 0x40]
xor eax, eax
test ecx, ecx
je 0x47d1ae
jmp 0x48ec70
ret 0x14
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
push 1
push 0
push ebx
mov esi, ecx
call fcn.004960f0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x48ec98
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14
push ebp
xor ebp, ebp
mov dword [esp + 0x10], ebp
cmp dword [edi + 0x44], ebp
je 0x48ed81
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.00494660
test eax, eax
je 0x48ece7
push ebp
push 0x5464f0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], ebp
call fcn.004a3620
add esp, 0x10
test eax, eax
jne 0x48ecf3
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 0x14
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 1
push eax
call fcn.00513fed
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005126eb
add esp, 0x14
cmp dword [esi + 0xc], ebp
jne 0x48ed29
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004946d0
mov ebp, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x24]
push ecx
push ebp
push 1
push eax
push edx
push esi
call fcn.00491e40
mov esi, eax
add esp, 0x18
test esi, esi
je 0x48ed57
cmp dword [esp + 0x2c], 0
je 0x48ed67
push ebx
jmp 0x48ed5f
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
push ecx
call fcn.00529b96
add esp, 4
mov ecx, dword [esp + 0x28]
mov ebx, ecx
test ecx, ecx
je 0x48edbf
call fcn.004a1da0
push ebx
call fcn.0051163f
add esp, 4
jmp 0x48edbf
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x48ede2
cmp dword [esi + 0xc], ebp
jne 0x48eda1
cmp dword [edi + 0x40], ebp
je 0x48eda1
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004946d0
mov ebp, eax
mov ecx, dword [esp + 0x10]
mov eax, ebp
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x34]
push eax
push ebx
push ecx
push esi
call fcn.00491e40
add esp, 0x18
mov esi, eax
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
test esi, esi
jne 0x48edd6
push ebp
call fcn.004a2fd0
add esp, 4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 0x14
mov ecx, dword [esp + 0x34]
jmp 0x48eda7
Function at 0x48dc30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52d7b6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
fld qword [edi + 0x10]
fstp qword [esi + 0x10]
push 4
fld qword [edi + 0x18]
fstp qword [esi + 0x18]
fld qword [edi + 0x20]
fstp qword [esi + 0x20]
fld qword [edi + 0x28]
fstp qword [esi + 0x28]
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov ecx, dword [edi + 0x54]
mov dword [esi + 0x54], ecx
mov eax, dword [edi + 0x58]
push eax
mov dword [esi + 0x58], eax
call fcn.004a30a0
mov edx, dword [esi + 0x58]
push 1
push edx
mov dword [esi + 0x48], eax
call fcn.004a30a0
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x58]
push 4
push eax
call fcn.004a30a0
xor ebx, ebx
add esp, 0x18
mov dword [esi + 0x50], eax
cmp dword [esi + 0x54], ebx
jle 0x48dd85
mov ecx, dword [edi + 0x48]
mov ebp, dword [ecx + ebx*4]
push 0x1c
call fcn.00511699
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x48dd1a
push ebp
mov ecx, eax
call fcn.0048f2b0
jmp 0x48dd1c
xor eax, eax
mov edx, dword [esi + 0x48]
mov dword [edx + ebx*4], eax
mov eax, dword [edi + 0x4c]
mov ecx, dword [esi + 0x4c]
mov dl, byte [ebx + eax]
or ebp, 0xffffffff
push 0x1c
mov dword [esp + 0x30], ebp
mov byte [ebx + ecx], dl
call fcn.00511699
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], 1
test eax, eax
je 0x48dd6f
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x34]
push ecx
mov ecx, dword [esi + 0x4c]
push edx
movzx edx, byte [ecx + ebx]
mov ecx, dword [esi + 0x48]
push edx
mov edx, dword [ecx + ebx*4]
push edx
mov ecx, eax
call fcn.00490650
jmp 0x48dd71
xor eax, eax
mov ecx, dword [esi + 0x50]
mov dword [ecx + ebx*4], eax
inc ebx
mov dword [esp + 0x2c], ebp
cmp ebx, dword [esi + 0x54]
jl 0x48dcf0
fld qword [esi + 0x20]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fnstcw word [esp + 0x14]
mov ax, word [esp + 0x14]
and ax, 0xf3ff
or ax, 0x800
mov word [esp + 0x34], ax
fldcw word [esp + 0x34]
fistp dword [esp + 0x18]
fldcw word [esp + 0x14]
mov eax, dword [esp + 0x18]
test eax, eax
jg 0x48ddbf
mov eax, 1
push eax
call fcn.004a3010
mov dword [esi + 0x5c], eax
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x495af0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52d9b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004a1870
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x28]
push edx
mov dword [esi + 0x48], ecx
push eax
mov ecx, esi
mov dword [esi], vtable.FoFiTrueType.0
call fcn.00495050
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x499f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
cmp byte [edi], 0
je 0x49a023
push esi
mov esi, dword [esp + 0xc]
movzx ecx, word [esi + 0xc]
mov eax, ecx
shr eax, 8
xor al, byte [edi]
push 1
movzx edx, al
add dx, cx
mov ecx, 0x3193
imul dx, cx
mov ecx, 0x58bf
sub cx, dx
cmp dword [esi + 8], 0
mov byte [esp + 0x14], al
mov word [esi + 0xc], cx
je 0x49a008
mov ecx, dword [esi]
movzx edx, al
mov eax, dword [esi + 4]
shr edx, 4
add edx, str.0123456789ABCDEF
push edx
push eax
call ecx
movzx edx, byte [esp + 0x1c]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
and edx, 0xf
push 1
add edx, str.0123456789ABCDEF
push edx
push eax
call ecx
add dword [esi + 0x10], 2
add esp, 0x18
cmp dword [esi + 0x10], 0x40
jne 0x49a018
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 1
push 0x534c40
push edx
call eax
mov dword [esi + 0x10], 0
jmp 0x49a015
mov edx, dword [esi + 4]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
call eax
add esp, 0xc
inc edi
cmp byte [edi], 0
jne 0x499f83
pop esi
pop edi
ret 8

Function at 0x49a030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
jle 0x49a0ea
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi + 0xc]
mov ecx, eax
shr ecx, 8
xor cl, byte [edi + ebx]
push 1
movzx edx, cl
add dx, ax
mov eax, 0x3193
imul dx, ax
mov eax, 0x58bf
sub ax, dx
cmp dword [esi + 8], 0
mov byte [esp + 0x14], cl
mov word [esi + 0xc], ax
je 0x49a0cd
mov edx, dword [esi + 4]
mov eax, dword [esi]
movzx ecx, cl
shr ecx, 4
add ecx, str.0123456789ABCDEF
push ecx
push edx
call eax
movzx ecx, byte [esp + 0x1c]
mov edx, dword [esi + 4]
mov eax, dword [esi]
and ecx, 0xf
push 1
add ecx, str.0123456789ABCDEF
push ecx
push edx
call eax
add dword [esi + 0x10], 2
add esp, 0x18
cmp dword [esi + 0x10], 0x40
jne 0x49a0dd
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 1
push 0x534c40
push ecx
call edx
mov dword [esi + 0x10], 0
jmp 0x49a0da
mov ecx, dword [esi + 4]
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
push ecx
call edx
add esp, 0xc
inc edi
cmp edi, dword [esp + 0x18]
jl 0x49a047
pop esi
pop ebx
pop edi
ret 0xc
Function at 0x4a18c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x544518
push eax
call fcn.00513e32
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a18db
pop esi
ret
push edi
push 2
push 0
push esi
call fcn.00514bbd
push esi
call fcn.00514ace
mov edi, eax
add esp, 0x10
test edi, edi
jns 0x4a1903
push esi
call fcn.005126eb
add esp, 4
pop edi
xor eax, eax
pop esi
ret
push ebx
push 0
push 0
push esi
call fcn.00514bbd
push edi
call fcn.004a3010
push esi
push edi
mov ebx, eax
push 1
push ebx
call fcn.00514432
add esp, 0x20
cmp eax, edi
je 0x4a193c
push ebx
call fcn.004a2fd0
push esi
call fcn.005126eb
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
ret
push esi
call fcn.005126eb
mov ecx, dword [esp + 0x18]
add esp, 4
mov eax, ebx
pop ebx
mov dword [ecx], edi
pop edi
pop esi
ret

Function at 0x4a3e20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0xc]
push edi
mov edi, dword [esi + 4]
lea eax, [edi + edi + 1]
push 4
push eax
mov dword [esp + 0x20], ebx
mov dword [esi + 4], eax
call fcn.004a30a0
mov dword [esi + 0xc], eax
xor eax, eax
add esp, 8
lea ebp, [eax + 1]
cmp dword [esi + 4], eax
jle 0x4a3e63
mov ecx, dword [esi + 0xc]
mov dword [ecx + eax*4], 0
add eax, ebp
cmp eax, dword [esi + 4]
jl 0x4a3e52
test edi, edi
jle 0x4a3ed5
mov dword [esp + 0x14], edi
jmp 0x4a3e70
cmp dword [ebx], 0
je 0x4a3ec8
mov ecx, dword [ebx]
mov edx, dword [ecx + 8]
mov dword [ebx], edx
mov edi, dword [ecx]
mov edx, dword [edi + 4]
mov edi, dword [edi]
xor eax, eax
test edi, edi
jle 0x4a3eaf
mov dword [esp + 0x10], edi
lea ecx, [ecx]
movsx edi, byte [edx]
mov ebp, eax
shl ebp, 4
add eax, ebp
and edi, 0xff
mov ebp, 1
add eax, edi
add edx, ebp
sub dword [esp + 0x10], ebp
jne 0x4a3e90
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [eax + edx*4], ecx
cmp dword [ebx], 0
jne 0x4a3e75
add ebx, 4
sub dword [esp + 0x14], ebp
jne 0x4a3e70
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004a2fd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4a3ef0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov edx, dword [edi + 4]
xor eax, eax
test esi, esi
jle 0x4a3f1b
push ebx
push ebp
movsx ebx, byte [edx]
mov ebp, eax
shl ebp, 4
and ebx, 0xff
add eax, ebp
add eax, ebx
inc edx
dec esi
jne 0x4a3f03
pop ebp
pop ebx
xor edx, edx
div dword [ecx + 4]
mov eax, dword [esp + 0x10]
mov dword [eax], edx
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + edx*4]
test esi, esi
je 0x4a3f43
mov ecx, dword [esi]
push edi
call fcn.004a2300
test eax, eax
je 0x4a3f4a
mov esi, dword [esi + 8]
test esi, esi
jne 0x4a3f30
pop edi
xor eax, eax
pop esi
ret 8
pop edi
mov eax, esi
pop esi
ret 8
Function at 0x4a3f60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [edi]
xor eax, eax
mov esi, edi
test dl, dl
je 0x4a3f8d
push ebx
movsx edx, dl
mov ebx, eax
shl ebx, 4
and edx, 0xff
add ebx, eax
add edx, ebx
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x4a3f71
pop ebx
xor edx, edx
div dword [ecx + 4]
mov eax, dword [esp + 0x10]
mov dword [eax], edx
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + edx*4]
test esi, esi
je 0x4a3fb5
mov ecx, dword [esi]
push edi
call fcn.004a2340
test eax, eax
je 0x4a3fbc
mov esi, dword [esi + 8]
test esi, esi
jne 0x4a3fa2
pop edi
xor eax, eax
pop esi
ret 8
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x4a3fd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
cmp eax, dword [edi + 4]
jl 0x4a3fe1
call fcn.004a3e20
push 0xc
call fcn.00511699
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx]
add esp, 4
xor eax, eax
test edx, edx
jle 0x4a401f
push ebx
push ebp
movsx ebx, byte [ecx]
mov ebp, eax
shl ebp, 4
and ebx, 0xff
add eax, ebp
add eax, ebx
inc ecx
dec edx
jne 0x4a4007
pop ebp
pop ebx
xor edx, edx
div dword [edi + 4]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0xc]
mov dword [eax + edx*4], esi
inc dword [edi + 8]
pop edi
pop esi
ret 8
Function at 0x4fcdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 0x130]
jge 0x4fce0e
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x231]
test eax, eax
je 0x4fce09
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x81
jmp 0x4fcead
mov edx, dword [ebp + 8]
cmp dword [edx + 0x130], 0
jle 0x4fcead
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
sub ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov cx, word [eax + ecx*4]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x98]
cmp edx, ecx
jb 0x4fce6f
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x231]
test eax, eax
je 0x4fce6d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x86
jmp 0x4fcec6
jmp 0x4fce93
movzx edx, word [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa8]
movzx edx, byte [ecx + edx]
xor edx, 1
movzx eax, word [ebp - 4]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xa8]
mov byte [eax + ecx], dl
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x130]
sub eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x130], eax
jmp 0x4fce0e
mov edx, dword [ebp + 8]
mov dword [edx + 0x130], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x20], edx
mov esp, ebp
pop ebp
ret
Function at 0x511afd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x59c6b8]
jne 0x511b07
repz ret
jmp fcn.0051917c

Function at 0x52652a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x59c6b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00518c21
and dword [ebp - 0x14], 0
cmp dword [0x59ecd0], 0
mov dword [ebp - 0x18], eax
jne 0x5265dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x526685
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x526685
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x59ecd0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x59ecd4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x59ecd8], eax
call edi
push eax
call esi
mov dword [0x59ece0], eax
test eax, eax
je 0x5265dd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x59ecdc], eax
mov eax, dword [0x59ecdc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x526636
cmp dword [0x59ece0], ecx
je 0x526636
push eax
call esi
push dword [0x59ece0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x526636
test ebx, ebx
je 0x526636
call edi
test eax, eax
je 0x52662d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x52662d
test byte [ebp - 8], 1
jne 0x526636
or dword [ebp + 0x10], 0x200000
jmp 0x526669
mov eax, dword [0x59ecd4]
cmp eax, dword [ebp - 0x18]
je 0x526669
push eax
call esi
test eax, eax
je 0x526669
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x526669
mov eax, dword [0x59ecd8]
cmp eax, dword [ebp - 0x18]
je 0x526669
push eax
call esi
test eax, eax
je 0x526669
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x59ecd0]
call esi
test eax, eax
je 0x526685
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x526687
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00511afd
leave
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219