joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df393
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x5bac98]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov ebx, ecx
mov eax, dword [0x5b9e7c]
cmp eax, dword [edx + 4]
jle 0x4df3ee
mov esi, 0x5b9e7c
push esi
call fcn.0052835f
cmp dword [0x5b9e7c], 0xffffffff
pop ecx
jne 0x4df3ee
call fcn.0040b30a
push eax
mov ecx, 0x5b9e78
call fcn.00402870
push 0x552e94
call fcn.0052822f
push esi
call fcn.00528320
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4df490
mov eax, dword [ebx + 0x34c]
test eax, eax
je 0x4df487
cmp dword [eax + 0x20], 0
je 0x4df487
test eax, eax
je 0x4df414
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4df487
mov eax, dword [edi + 4]
sub eax, 1
je 0x4df45b
sub eax, 1
je 0x4df431
sub eax, 1
jne 0x4df487
mov esi, 0x428e
jmp 0x4df460
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4df460
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x340]
test eax, eax
je 0x4df460
add esi, 3
jmp 0x4df460
mov esi, 0x3ea0
push esi
call fcn.0040bb13
test eax, eax
je 0x4df490
push esi
push eax
mov ecx, 0x5b9e78
call fcn.00402350
test eax, eax
je 0x4df490
mov eax, dword [0x5b9e78]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4df489
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.0040adb0
int3
Function at 0x5013e2
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x550dc5
call fcn.005284dc
mov ebx, ecx
mov dword [ebp - 0x230], ebx
call fcn.00512b1a
push 0x1c4
call fcn.00407b0b
pop ecx
mov dword [ebp - 0x22c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x501425
push 0
push dword [ebx + 0x60]
mov ecx, eax
call fcn.00513131
jmp 0x501427
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.00511f64
call fcn.00412ce5
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x8c]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call fcn.0052f665
mov esi, eax
pop ecx
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
mov dword [ebp - 0x22c], esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x50163e
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x228], eax
test edi, edi
je 0x501638
xor ebx, ebx
cmp dword [edi + 4], eax
jle 0x501638
call fcn.0040b30a
push eax
lea ecx, [ebp - 0x21c]
call fcn.00402870
mov eax, dword [edi]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x218]
push esi
push ecx
push ebx
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
je 0x50161c
push 0x561460
mov esi, 0x561468
lea ecx, [ebp - 0x21c]
push esi
call fcn.00441c15
push esi
push 0x585194
lea ecx, [ebp - 0x21c]
call fcn.00441c15
push esi
push 0x561460
lea ecx, [ebp - 0x21c]
call fcn.00441c15
call fcn.0040b30a
push eax
lea ecx, [ebp - 0x220]
call fcn.00402870
mov eax, dword [ebp - 0x228]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x501552
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__Ts
push eax
call fcn.00402c60
add esp, 0xc
jmp 0x501584
jge 0x501572
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__Ts
push eax
call fcn.00402c60
add esp, 0x10
jmp 0x501584
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040b2a3
push 0x1c4
call fcn.00407b0b
pop ecx
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x5015ae
mov ecx, eax
call fcn.004b7ed7
mov ecx, eax
mov dword [ebp - 0x224], eax
jmp 0x5015b6
xor ecx, ecx
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov esi, dword [ebp - 0x220]
push esi
mov byte [ebp - 4], 2
call dword [eax + 0xb4]
mov ecx, dword [ebp - 0x224]
lea eax, [ebx + 0xe110]
push eax
mov edx, dword [ecx]
call dword [edx + 0xb0]
push ebx
mov ecx, edi
call fcn.00416c32
mov ecx, dword [ebp - 0x224]
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc8]
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 0x230]
call fcn.00511f64
inc dword [ebp - 0x228]
lea ecx, [esi - 0x10]
call fcn.004029b0
mov esi, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.004029b0
inc ebx
cmp ebx, dword [edi + 4]
jl 0x5014a7
call fcn.00528486
ret
call fcn.00528887
int3

Function at 0x540dd2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00540a92
Function at 0x54e10d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x54e148
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x54e12f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x54e140
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x54e14a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x54e125
xor eax, eax
pop edi
pop esi
ret
Function at 0x416eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x416faa
xor ebx, ebx
test al, al
jle 0x416f47
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x416f2e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004e59d0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x416f33
call fcn.0040d5a0
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x416ee0
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x416f9f
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004e59d0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0040d5a0
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x549944]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
cmp byte [esi + 0x11], 0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ecx
je 0x41b60a
mov edi, dword [esp + 0x10]
lea esi, [eax + 1]
lea ebx, [esi - 2]
cmp esi, 2
jae 0x41b570
xor edx, edx
jmp 0x41b59f
mov eax, 0xcccccccd
mul dword [edi + 0x24]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x54b1cc]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x20]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x41b5b2
mov eax, dword [0x54b1cc]
xor edx, edx
div dword [edi + 0x20]
inc eax
cmp esi, eax
jne 0x41b5b6
inc esi
inc ebx
jmp 0x41b567
cmp esi, dword [edi + 0x2c]
mov edi, 0
ja 0x41b600
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x13]
mov edx, esi
push eax
call fcn.00417490
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x41b672
cmp byte [esp + 0xf], 4
mov edx, dword [esp + 0x14]
jne 0x41b5fa
cmp dword [esp + 0x20], edx
jne 0x41b5fa
mov eax, esi
lea ebx, [edi + 0x65]
jmp 0x41b674
mov esi, dword [esp + 0x10]
jmp 0x41b60c
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x41b60c
mov edx, eax
mov ecx, dword [esi]
xor eax, eax
cmp dword [esp + 0x18], eax
mov ebx, 2
cmove eax, ebx
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [ecx + 0xc8]
push edx
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x41b672
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edi, dword [edx + 8]
cmp eax, dword [edi + 4]
je 0x41b667
mov ecx, dword [edx + 4]
cmp eax, 1
mov dword [edi + 4], eax
setne al
mov dword [edi + 0x38], ecx
dec al
mov dword [edi + 0x48], edx
and al, 0x64
mov dword [edi + 0x34], esi
mov byte [edi + 9], al
mov eax, dword [ecx]
bswap eax
jmp 0x41b674
mov ecx, dword [edi + 0x38]
xor ebx, ebx
mov eax, dword [ecx]
bswap eax
jmp 0x41b674
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41b686
mov dword [eax], edi
jmp 0x41b6d9
test edi, edi
je 0x41b6d9
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x41b6d2
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004e59d0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x41b6d9
mov ecx, edx
call fcn.0040d5a0
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004e5962
mov esp, ebp
pop ebp
ret
Function at 0x41db40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
push esi
push ebx
push edi
mov eax, dword [edi + 0x50]
call eax
movzx eax, word [esi + 0x10]
add esp, 0xc
mov edx, dword [esi + 0xc]
mov dword [esp + 0x14], eax
cmp eax, edx
je 0x41dd1f
movzx esi, word [esi + 0x12]
lea eax, [ebx - 1]
movzx ecx, word [edi + 0x18]
add eax, esi
add ecx, dword [edi + 0x38]
cmp eax, ecx
jbe 0x41dbaf
push 0x53d0b4
push 0x10135
push 0x53d048
push 0x53d02c
push 0xb
call fcn.00407720
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0x34]
sub edx, dword [esp + 0x14]
mov esi, dword [esi + ebx - 4]
bswap esi
mov ecx, dword [edi + 0x24]
sub ecx, 4
mov dword [esp + 0xc], edi
lea eax, [edx - 1]
xor edx, edx
add eax, ecx
div ecx
mov ebx, eax
test ebx, ebx
je 0x41dd1f
nop dword [eax]
dec ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
cmp esi, 2
jb 0x41dcf5
cmp esi, dword [edi + 0x2c]
ja 0x41dcf5
test ebx, ebx
je 0x41dc31
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0041b520
add esp, 8
test eax, eax
jne 0x41dd21
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x41dc40
mov edi, dword [esp + 0xc]
mov edx, esi
mov ecx, edi
call fcn.00418650
mov edi, eax
test edi, edi
je 0x41dc72
mov ecx, dword [edi + 0x48]
cmp word [ecx + 0x1e], 1
je 0x41dc72
push 0x53d0b4
push 0x1015a
push 0x53d048
push 0x53d02c
push 0xb
call fcn.00407720
add esp, 0x14
mov dword [esp + 0x10], 0xb
jmp 0x41dc85
mov ecx, dword [esp + 0xc]
mov edx, edi
push esi
call fcn.0041d5e0
add esp, 4
mov dword [esp + 0x10], eax
test edi, edi
je 0x41dcdc
mov edx, dword [edi + 0x48]
test edx, edx
je 0x41dcdc
test byte [edx + 0x1c], 0x20
je 0x41dcd5
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004e59d0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x41dcdc
mov ecx, edx
call fcn.0040d5a0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41dd21
mov esi, dword [esp + 0x14]
test ebx, ebx
je 0x41dd1f
mov edi, dword [esp + 0xc]
jmp 0x41dbe0
push 0x53d0b4
push 0x10146
push 0x53d048
push 0x53d02c
push 0xb
call fcn.00407720
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], edx
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov ecx, dword [esi + 0x48]
mov ebx, dword [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x420383
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x420383
cmp dword [edx + 0x60], edi
je 0x4203b6
call fcn.004118e0
jmp 0x4203a8
mov ebx, dword [edx + 0x28]
test ebx, ebx
jne 0x420472
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x4203a3
call fcn.00413410
jmp 0x4203a8
call fcn.00413340
mov ebx, eax
test ebx, ebx
jne 0x420472
mov ebx, dword [esp + 0x10]
push 0
push dword [esi + 4]
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
lea edx, [esp + 0x24]
call fcn.0041c9e0
mov edi, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x10], eax
mov edx, edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.0041ee70
add esp, 4
cmp byte [ebx + 0x11], 0
je 0x420405
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
mov ecx, ebx
push 5
call fcn.00417290
add esp, 0xc
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x420472
movzx eax, byte [esi + 0xc]
add eax, eax
push eax
lea eax, [esi + 0x1a]
push eax
lea eax, [edi + 0x1a]
push eax
call fcn.004e8950
movzx eax, byte [esi + 0xc]
add esp, 0xc
shl eax, 2
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [edi + 0x24]
push eax
call fcn.004e8950
mov al, byte [esi + 0xc]
add esp, 0xc
mov byte [edi + 0xc], al
mov ecx, esi
mov eax, dword [edi + 0x38]
movzx edx, byte [eax]
and edx, 0xfffffff7
call fcn.00418580
mov eax, dword [esi + 0x38]
movzx ecx, byte [esi + 9]
mov edx, dword [esp + 0x14]
bswap edx
mov dword [ecx + eax + 8], edx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [eax], 0
test edi, edi
je 0x4204d4
mov ecx, dword [edi + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x4204cf
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov esi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004e59d0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040d5a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.00404e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x436a50
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x54a41c], 0
mov edi, dword [ebp + 8]
je 0x436a9a
mov eax, dword [0x54a51c]
test eax, eax
je 0x436a73
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x436a9a
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x407990
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.004f8445
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x436aa7
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x436ac0
call dword [0x51d234]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 8], edx
push edi
mov esi, edx
mov dword [ebp - 0xc], eax
xor ebx, ebx
cmp dword [eax + 0x14], ebx
jle 0x44a3e0
nop
mov edx, dword [ebp + 8]
mov edi, ebx
xor edi, 1
cmp ebx, 2
cmovge edi, ebx
test edx, edx
je 0x44a425
mov eax, dword [eax + 0x10]
mov ecx, edi
add ecx, ecx
mov esi, edx
mov eax, dword [eax + ecx*8]
mov dword [ebp - 4], eax
mov al, byte [edx]
movzx ecx, al
movzx edx, byte [ecx + 0x53ea00]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
movzx ecx, byte [ecx + 0x53ea00]
sub edx, ecx
jne 0x44a3d4
mov ecx, dword [ebp - 4]
sub ecx, esi
mov dword [ebp - 4], ecx
nop word [eax + eax]
test al, al
je 0x44a41f
movzx ecx, byte [ecx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x53ea00]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x53ea00]
sub ecx, edx
mov ecx, dword [ebp - 4]
je 0x44a3b0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc ebx
cmp ebx, dword [eax + 0x14]
jl 0x44a360
mov dl, byte [esi]
movzx eax, dl
cmp byte [eax + 0x53ea00], 0x73
jne 0x44a416
mov edi, 0x5398b4
sub edi, esi
test dl, dl
je 0x44a446
movzx eax, byte [edi + esi + 1]
inc esi
movzx ecx, byte [eax + 0x53ea00]
mov dl, byte [esi]
movzx eax, dl
movzx eax, byte [eax + 0x53ea00]
sub eax, ecx
je 0x44a3f5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
add edi, edi
push 0
mov edx, esi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.00409680
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x44a418
jmp 0x44a3d7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
push dword [ebp + 8]
call fcn.00408320
add esp, 8
test eax, eax
jne 0x44a416
mov eax, dword [ebp - 0xc]
mov esi, 0x53a7e0
mov dword [ebp - 8], esi
jmp 0x44a353
Function at 0x44a600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x14], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x44a6b5
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x44a696
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x53ea00]
movzx ecx, al
movzx ecx, byte [ecx + 0x53ea00]
sub ecx, edx
jne 0x44a681
sub ebx, esi
test al, al
je 0x44a696
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x53ea00]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x53ea00]
sub ecx, edx
je 0x44a660
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x44a621
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.00409680
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x44a68d
jmp 0x44a684
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4b2320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x54920c
mov eax, dword [ebp + 8]
push eax
call fcn.004f5bc6
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b2347
xor eax, eax
jmp 0x4b241a
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f6154
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.004f67f2
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4b237f
mov eax, dword [ebp - 4]
push eax
call fcn.004f5957
add esp, 4
xor eax, eax
jmp 0x4b241a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004f67fd
add esp, 4
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call dword [0x5491fc]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b23ba
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f5957
add esp, 4
xor eax, eax
jmp 0x4b241a
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004f5dc3
add esp, 0x10
cmp eax, 1
jae 0x4b2402
mov edx, dword [ebp - 4]
push edx
call fcn.004f59db
add esp, 4
test eax, eax
je 0x4b2402
mov eax, dword [ebp - 4]
push eax
call fcn.004f5957
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [0x549200]
add esp, 4
xor eax, eax
jmp 0x4b241a
mov edx, dword [ebp - 4]
push edx
call fcn.004f5957
add esp, 4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4b4790
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x6a09e667
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0xbb67ae85
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x3c6ef372
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xa54ff53a
mov edx, 4
shl edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x510e527f
mov ecx, 4
imul edx, ecx, 5
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x9b05688c
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x1f83d9ab
mov ecx, 4
imul edx, ecx, 7
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x5be0cd19
mov esp, ebp
pop ebp
ret