joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
cmp byte [edx + 0x17d], 0
call fcn.004328c2

Function at 0x4393a3
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
mov edi, dword [edx]
mov eax, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0x20], ecx
lea ecx, [edi + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
push ecx
call sub.KERNEL32.DLL_AcquireSRWLockShared
mov al, byte [edi + 0x24]
test al, al
jne 0x4394e2
cmp dword [edi + 0x30], 0
je 0x4393fc
lea ebx, [ebp - 0x38]
mov edx, edi
mov ecx, ebx
push dword [esi + 4]
call fcn.00439508
pop eax
cmp byte [ebx], 4
je 0x4393fc
mov eax, dword [ebp - 0x38]
cmp al, 4
jne 0x4394c7
cmp dword [edi + 8], 0
je 0x439462
lea esi, [ebp - 0x38]
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.004044e5
mov ecx, esi
mov edx, 0x6260d4
call fcn.0043935a
mov byte [ebp - 0xd], dl
lea ebx, [eax + 8]
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, ebx
add eax, edx
push eax
call fcn.004d5e5b
pop eax
push 0xa
pop edx
mov ecx, ebx
call fcn.00438886
mov edx, dword [edi + 0x2c]
mov eax, dword [edi + 0x30]
mov ecx, ebx
add eax, edx
push eax
call fcn.004d5e5b
pop eax
mov eax, dword [ebp - 0x14]
movzx edx, byte [ebp - 0xd]
mov ecx, esi
mov byte [eax], 4
call fcn.0050cbf4
jmp 0x4394d2
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
lea edx, [ebp - 0x40]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x5c]
mov dword [ecx], eax
mov eax, fcn.00426659
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
lea edx, [ebp - 0x38]
mov dword [ecx + 0xc], eax
mov dword [edx], 0x64bc18
push 2
pop eax
mov dword [edx + 4], eax
and dword [edx + 0x10], 0
lea esi, [ebp - 0x4c]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], eax
mov ecx, esi
call fcn.004385f2
mov ebx, dword [esi + 4]
mov ecx, dword [ebp - 0x14]
mov edx, edi
push dword [esi + 8]
push ebx
call fcn.0043928c
pop eax
pop ecx
mov ecx, dword [esi]
mov edx, ebx
call fcn.00563c9c
jmp 0x4394d2
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov dword [edx], eax
mov dword [edx + 4], ecx
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_ReleaseSRWLockShared
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x18]
add edi, 0x28
lea eax, [ebp - 0x38]
mov dword [eax], edi
mov dword [eax + 4], ecx
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x6260c4
push 0x625fe8
push eax
call fcn.0043f6f0
Function at 0x439508
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
cmp byte [ebp + 8], 0
mov esi, ecx
je 0x43952e
mov ecx, esi
push 5
push str._re_2K_re_2J_re_He__25he__25lC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fconsole_0.15.8_src_term.rsV_b
call fcn.00439226
pop eax
pop ecx
jmp 0x4395b4
mov ecx, edx
call fcn.00438bf4
lea edi, [ebp - 0x44]
mov edx, eax
mov ecx, edi
call fcn.004395bc
cmp dword [edi], 0
je 0x4395b1
movzx eax, word [ebp - 0x34]
movzx ebx, word [ebp - 0x36]
lea edi, [ebp - 0x24]
and word [ebp - 0x10], 0
mov ecx, dword [ebp - 0x40]
and dword [edi], 0
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x2e]
mov word [ebp - 0xe], bx
sub ax, word [ebp - 0x32]
movsx edx, ax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
push edi
push eax
push edx
push 0x20
push ecx
mov edi, ecx
call sub.KERNEL32.DLL_FillConsoleOutputCharacterA
and word [ebp - 0x14], 0
mov word [ebp - 0x12], bx
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
call sub.KERNEL32.DLL_FillConsoleOutputAttribute
and word [ebp - 0x18], 0
mov word [ebp - 0x16], bx
mov eax, dword [ebp - 0x18]
push eax
push edi
call sub.KERNEL32.DLL_SetConsoleCursorPosition
mov byte [esi], 4
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x439da3
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
mov ebx, ecx
je 0x439e24
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x3c]
inc esi
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov edi, ebx
lea ebx, [ebp - 0x48]
mov dword [eax], esi
lea esi, [ebp - 0x58]
mov dword [edx], 0x626024
mov dword [edx + 4], 3
and dword [edx + 0x10], 0
mov dword [ecx], 1
mov dword [esi], eax
mov eax, fcn.0043a0b0
mov dword [edx + 8], esi
mov dword [edx + 0xc], 2
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, ebx
mov dword [esi + 0xc], eax
call fcn.004385f2
mov esi, dword [ebx + 4]
mov edx, dword [ebp - 0x14]
mov ecx, edi
push dword [ebx + 8]
push esi
call fcn.00439226
pop eax
pop ecx
mov ecx, dword [ebx]
mov edx, esi
call fcn.00563c9c
jmp 0x439e55
mov ecx, edx
call fcn.00438bf4
lea edi, [ebp - 0x3c]
mov edx, eax
mov ecx, edi
call fcn.004395bc
cmp dword [edi], 0
je 0x439e52
and word [ebp - 0x10], 0
mov word [ebp - 0xe], si
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call sub.KERNEL32.DLL_SetConsoleCursorPosition
mov byte [ebx], 4
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x442280
cmp esi, edi
ja 0x4422eb
cmp edi, dword [ebp + 0x10]
ja 0x4422f9
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x442282
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x442270
jmp 0x4422df
ja 0x442289
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x442245
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x4422c0
mov ebx, esi
sub ecx, edx
jns 0x4422d7
jmp 0x4422e1
cmp esi, edi
je 0x442308
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4422e1
xor al, 1
cmp ebx, edi
jne 0x4422a0
jmp 0x4422e1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x6278dc
call fcn.0043e3d0
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x6278dc
call fcn.0043a6f0
mov ecx, str.called__Option::unwrap____on_a__None__valueC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.6_srcwin.rs
mov edx, 0x2b
push 0x6278cc
call fcn.0043a9e0
nop dword [eax]

Function at 0x442ee0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, 0x81
mov esi, 0x30
mov ebx, ecx
nop dword [eax + eax]
mov bh, cl
mov edi, eax
shr bl, 4
mov eax, 0x37
and bh, 0xf
cmp bh, 0xa
cmovb eax, esi
add al, bh
cmp cl, 0x10
mov ecx, ebx
mov byte [ebp + edi - 0x8e], al
lea eax, [edi - 1]
jae 0x442f00
add edi, 0xfffffffe
cmp edi, 0x80
ja 0x442f61
mov esi, 0x81
mov ecx, edx
mov edx, 1
sub esi, eax
lea eax, [ebp + edi - 0x8c]
push esi
push eax
push 2
push str.0x0Xl_l
call fcn.0043a1b0
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, pe_nt_image_headers32
push 0x6273bc
call fcn.00439ff0
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x4461af
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x40c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edi, dword [eax]
and dword [eax], 0
test edi, edi
je 0x446216
lea ecx, [ebp - 0x414]
and dword [ecx + 0x408], 0
call fcn.00445fc7
mov esi, eax
push 0x40
pop edx
mov ecx, 0x140
call fcn.00483e0a
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x40], esi
mov dword [eax + 0x80], esi
and dword [eax + 0xc0], 0
and dword [eax + 0x100], 0
mov ecx, dword [edi]
mov dword [ecx], eax
add esp, 0x40c
pop esi
pop edi
pop ebp
ret
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__valueC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.6_srcwin.rs
push 0x69b0e0
call fcn.0043a9e0
Function at 0x4486ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
lea edi, [ebp - 0xc]
mov esi, ecx
and dword [edi], 0
push edi
push 0
push 0
push edx
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
mov eax, dword [edi]
je 0x4486e7
push eax
call sub.ole32.dll_CoTaskMemFree
mov dword [esi], 0x80000000
jmp 0x448701
push eax
call sub.KERNEL32.DLL_lstrlenW
mov edx, dword [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00522900
pop eax
push dword [ebp - 0xc]
call sub.ole32.dll_CoTaskMemFree
add esp, 4
pop esi
pop edi
pop ebp
ret

Function at 0x448fea
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x10]
test edi, edi
je 0x44902f
lea eax, [esi + edi]
mov ebx, edi
mov dword [ebp - 0x10], eax
push 2
push edi
push esi
push 0
call sub.bcrypt.dll_BCryptGenRandom
xor edi, edi
cmp eax, 0xbfffffff
jbe 0x448ff6
push ebx
push esi
mov esi, eax
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x448ff6
mov eax, esi
add eax, 0x80000000
jmp 0x449031
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x456142
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 9
jne 0x456148
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, edx
mov esi, ecx
push 0xa
pop ecx
mov ebx, esp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push eax
push 0x63be78
push ebx
call fcn.0043f6f0
Function at 0x45b16c
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, eax
sub edi, esi
jb 0x45b190
cmp eax, edx
ja 0x45b19a
add ecx, esi
mov edx, edi
mov eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, eax
push ebx
call fcn.0043e3d0
mov ecx, eax
push ebx
call fcn.0043a6f0

Function at 0x45cbcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
call fcn.0045cbe0

Function at 0x45f8e4
Capabilities:
Read file on windows

Disassembly:
test ecx, ecx
je 0x45f8eb
mov eax, ecx
ret
push ebp
mov ebp, esp
mov eax, edx
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__valueC:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.6_srcwin.rs
push eax
call fcn.0043a9e0
Function at 0x473811
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
add ecx, 0x20
call fcn.00473bd6
and dword [esi + 4], 0
and dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
pop esi
pop ebp
ret

Function at 0x478d8f
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, ecx
add ecx, 0x28
call fcn.00473bd6
push 8
pop ecx
mov edi, ebx
mov esi, 0x640e50
rep movsd dword es:[edi], dword [esi]
and dword [ebx + 0x24], 0
and dword [ebx + 0x20], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x480d45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
push 8
pop ecx
and dword [esp + 0x60], 0
lea esi, [esp + 0x3c]
test eax, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esi], ecx
mov dword [esp + 0x14], esi
je 0x480d8d
mov edx, eax
and eax, 7
shr edx, 3
cmp eax, 1
sbb edx, 0xffffffff
jmp 0x480d8f
xor edx, edx
lea esi, [esp + 0x40]
mov ecx, esi
call fcn.0047da3c
mov eax, dword [esi + 0x20]
cmp eax, 5
cmovae esi, dword [esi]
push 4
pop edi
push 0x20
pop ecx
cmovae ecx, edi
cmovae edi, eax
mov ebx, dword [esp + ecx + 0x40]
mov dword [esp], ecx
cmp ebx, edi
jae 0x480de0
lea ecx, [esp + 0x18]
lea edx, [esp + 8]
call fcn.0047dd99
cmp dword [esp + 0x18], 1
jne 0x480e2a
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esi + ebx*8], ecx
mov dword [esi + ebx*8 + 4], eax
inc ebx
jmp 0x480db6
mov eax, dword [esp]
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
lea esi, [esp + 0x68]
lea edi, [esp + 0x28]
mov dword [esp + eax + 0x40], ebx
lea ebx, [esp + 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov ecx, edi
mov edx, esi
call fcn.0047dd99
cmp dword [esp + 0x28], 0
je 0x480e31
mov edx, dword [esp + 0x30]
mov ecx, ebx
push dword [esp + 0x34]
call fcn.0047da88
pop eax
jmp 0x480e08
mov eax, dword [esp]
mov dword [esp + eax + 0x40], ebx
mov eax, dword [esp + 4]
push 0xa
pop ecx
lea edx, [esp + 0x78]
lea esi, [esp + 0x40]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.0047e0c1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4835ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov esi, ecx
lea ecx, [ebp - 0x58]
mov ebx, edx
call fcn.00483cc2
lea edi, [ebp - 0x8c]
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00483c9f
mov edi, dword [edi]
cmp edi, 2
jne 0x48363a
movzx ecx, word [ebp - 0x88]
mov al, byte [ebp - 0x86]
lea edi, [ebp - 0x58]
mov edx, ebx
mov dword [ebp - 0x24], esi
mov word [ebp - 0x14], cx
mov ecx, edi
mov byte [ebp - 0x12], al
call fcn.00483cc2
mov eax, dword [edi]
cmp eax, 2
jne 0x4836c1
movzx eax, byte [ebp - 0x54]
test al, al
js 0x483672
mov ebx, eax
and ebx, 0xffffff00
mov ecx, dword [ebp - 0x24]
movzx edx, word [ebp - 0x14]
or ebx, eax
mov al, byte [ebp - 0x12]
mov word [ecx + 8], dx
mov byte [ecx + 0xa], al
mov dword [ecx + 4], ebx
mov dword [ecx], 2
jmp 0x483764
lea eax, [ebp - 0x85]
mov cl, byte [eax - 1]
mov byte [ebp - 0xe], cl
movzx ecx, word [eax - 3]
mov word [ebp - 0x10], cx
lea ecx, [esi + 7]
push 0x2d
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov al, byte [ebp - 0xe]
movzx ecx, word [ebp - 0x10]
mov byte [esi + 6], al
mov word [esi + 4], cx
mov dword [esi], edi
jmp 0x483764
cmp eax, 0x80
jne 0x483684
mov dword [ebp - 0x1c], 0
mov cl, 5
jmp 0x4836f5
cmp al, 0x84
ja 0x48376f
mov edi, eax
mov esi, ebx
xor ebx, ebx
mov dword [ebp - 0x20], eax
xor edi, 0x80
sub edi, 1
jb 0x48377d
lea ecx, [ebp - 0x58]
mov edx, esi
call fcn.00483cc2
mov eax, dword [ebp - 0x58]
cmp eax, 2
jne 0x4836c1
movzx eax, byte [ebp - 0x54]
shl ebx, 8
or ebx, eax
jmp 0x48369b
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
movzx ecx, byte [esi - 5]
movzx edx, word [esi - 7]
mov al, byte [esi - 8]
mov ah, byte [esi - 4]
shl ecx, 0x10
or edx, ecx
movzx ecx, word [esi - 3]
mov word [ebp - 0x18], cx
mov cl, byte [esi - 1]
mov byte [ebp - 0x16], cl
push 0xa
pop ecx
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov cl, ah
shl edx, 8
movzx eax, al
or eax, edx
cmp cl, 0xd
jne 0x48371b
movzx edx, word [ebp - 0x14]
mov cl, byte [ebp - 0x12]
xor ebx, ebx
mov byte [ebp - 0x20], 6
mov word [ebp - 0x10], dx
mov edx, dword [ebp - 0x24]
mov byte [ebp - 0xe], cl
jmp 0x483740
mov byte [ebp - 0x20], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0xe], cl
movzx ecx, word [ebp - 0x18]
mov word [ebp - 0x10], cx
push 0xa
pop ecx
lea edi, [ebp - 0x58]
lea esi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebp - 0xe]
lea edi, [edx + 0xc]
mov byte [edx + 0xb], cl
movzx ecx, word [ebp - 0x10]
mov word [edx + 9], cx
push 0xa
pop ecx
lea esi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
mov dword [edx], ebx
mov dword [edx + 4], eax
mov al, byte [ebp - 0x20]
mov byte [edx + 8], al
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], 0
mov cl, 0xd
jmp 0x4836f5
cmp ebx, 0xfffffff
ja 0x4837aa
mov ecx, ebx
mov dword [ebp - 0x1c], 0
call fcn.00483c56
test al, al
je 0x483776
cmp dl, byte [ebp - 0x20]
mov cl, 0xd
jne 0x4836f5
movzx eax, bl
jmp 0x483613
mov dword [ebp - 0x1c], 0
mov cl, 0xc
xor edx, edx
jmp 0x483682
Function at 0x4837ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov esi, ecx
lea ecx, [ebp - 0x58]
mov ebx, edx
call fcn.004839c8
lea edi, [ebp - 0x8c]
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00483c9f
mov edi, dword [edi]
cmp edi, 2
jne 0x483848
movzx ecx, word [ebp - 0x88]
mov al, byte [ebp - 0x86]
lea edi, [ebp - 0x58]
mov edx, ebx
mov dword [ebp - 0x24], esi
mov word [ebp - 0x14], cx
mov ecx, edi
mov byte [ebp - 0x12], al
call fcn.004839c8
mov eax, dword [edi]
cmp eax, 2
jne 0x4838cf
movzx eax, byte [ebp - 0x54]
test al, al
js 0x483880
mov ebx, eax
and ebx, 0xffffff00
mov ecx, dword [ebp - 0x24]
movzx edx, word [ebp - 0x14]
or ebx, eax
mov al, byte [ebp - 0x12]
mov word [ecx + 8], dx
mov byte [ecx + 0xa], al
mov dword [ecx + 4], ebx
mov dword [ecx], 2
jmp 0x483972
lea eax, [ebp - 0x85]
mov cl, byte [eax - 1]
mov byte [ebp - 0xe], cl
movzx ecx, word [eax - 3]
mov word [ebp - 0x10], cx
lea ecx, [esi + 7]
push 0x2d
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov al, byte [ebp - 0xe]
movzx ecx, word [ebp - 0x10]
mov byte [esi + 6], al
mov word [esi + 4], cx
mov dword [esi], edi
jmp 0x483972
cmp eax, 0x80
jne 0x483892
mov dword [ebp - 0x1c], 0
mov cl, 5
jmp 0x483903
cmp al, 0x84
ja 0x48397d
mov edi, eax
mov esi, ebx
xor ebx, ebx
mov dword [ebp - 0x20], eax
xor edi, 0x80
sub edi, 1
jb 0x48398b
lea ecx, [ebp - 0x58]
mov edx, esi
call fcn.004839c8
mov eax, dword [ebp - 0x58]
cmp eax, 2
jne 0x4838cf
movzx eax, byte [ebp - 0x54]
shl ebx, 8
or ebx, eax
jmp 0x4838a9
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
movzx ecx, byte [esi - 5]
movzx edx, word [esi - 7]
mov al, byte [esi - 8]
mov ah, byte [esi - 4]
shl ecx, 0x10
or edx, ecx
movzx ecx, word [esi - 3]
mov word [ebp - 0x18], cx
mov cl, byte [esi - 1]
mov byte [ebp - 0x16], cl
push 0xa
pop ecx
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov cl, ah
shl edx, 8
movzx eax, al
or eax, edx
cmp cl, 0xd
jne 0x483929
movzx edx, word [ebp - 0x14]
mov cl, byte [ebp - 0x12]
xor ebx, ebx
mov byte [ebp - 0x20], 6
mov word [ebp - 0x10], dx
mov edx, dword [ebp - 0x24]
mov byte [ebp - 0xe], cl
jmp 0x48394e
mov byte [ebp - 0x20], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0xe], cl
movzx ecx, word [ebp - 0x18]
mov word [ebp - 0x10], cx
push 0xa
pop ecx
lea edi, [ebp - 0x58]
lea esi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebp - 0xe]
lea edi, [edx + 0xc]
mov byte [edx + 0xb], cl
movzx ecx, word [ebp - 0x10]
mov word [edx + 9], cx
push 0xa
pop ecx
lea esi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
mov dword [edx], ebx
mov dword [edx + 4], eax
mov al, byte [ebp - 0x20]
mov byte [edx + 8], al
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], 0
mov cl, 0xd
jmp 0x483903
cmp ebx, 0xfffffff
ja 0x4839b8
mov ecx, ebx
mov dword [ebp - 0x1c], 0
call fcn.00483c56
test al, al
je 0x483984
cmp dl, byte [ebp - 0x20]
mov cl, 0xd
jne 0x483903
movzx eax, bl
jmp 0x483821
mov dword [ebp - 0x1c], 0
mov cl, 0xc
xor edx, edx
jmp 0x483890
Function at 0x494127
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, edx
mov ebx, ecx
lea edi, [esp + 8]
mov ecx, edi
push 0
call fcn.00494b3b
pop eax
mov eax, dword [edi]
cmp eax, 0x2a
jne 0x4941ea
mov dword [esp], ebx
mov ebx, dword [esi + 4]
mov eax, dword [ebx + 0x1c]
cmp eax, 1
mov dword [esp + 4], eax
jne 0x49422b
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
push 0x647eb8
push 0
call fcn.00494c4c
pop ecx
pop edx
cmp byte [eax + 0xc], 0
jne 0x494246
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x494219
dec eax
mov dword [ebx + 0x1c], eax
shl eax, 4
mov ecx, dword [ebx + 0x18]
mov edx, dword [ecx + eax]
cmp edx, 0x80000000
je 0x494219
add ecx, eax
lea edi, [esp + 0x48]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edi], edx
mov edx, dword [esi]
mov dword [edi + 8], ecx
mov dword [edi + 4], eax
lea ecx, [esp + 8]
push edi
push ebx
call fcn.00494ccb
pop eax
pop ecx
lea eax, [esp + 8]
mov eax, dword [eax]
cmp eax, 0x2a
jne 0x4941fa
mov eax, dword [esp + 0xc]
mov edx, dword [esp]
mov ecx, dword [esi + 8]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [edx], 0x2a
jmp 0x494211
lea esi, [esp + 0xc]
lea edi, [ebx + 4]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
jmp 0x494211
lea esi, [esp + 0x10]
mov ebx, dword [esp]
mov edx, dword [esi - 4]
lea edi, [ebx + 8]
push 0xe
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop edx
mov ecx, str.non_empty_nodes
push 0x647f14
call fcn.004408d0
and dword [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
push 0x647f24
push edi
push 0x69df08
call fcn.00426a58
push 0x39
pop edx
mov ecx, str.assertion_failed:_self.state.uncompiled_0_.last.is_none__
push 0x647f04
call fcn.0043a9e0
Function at 0x4e3dad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edx, ecx
imul eax, esi, 0x1c
shr esi, 1
add eax, ecx
mov ecx, esi
neg ecx
imul edi, ecx, 0x1c
mov ecx, esi
add edi, eax
push 0x6c34f4
push esi
call fcn.00497c91
pop ecx
pop ecx
mov dword [ebp - 0x14], edx
mov ebx, eax
mov edx, edi
mov ecx, esi
push 0x6c3504
push esi
call fcn.00497c91
pop ecx
pop ecx
imul edi, esi, 0x1c
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x18], esi
add edi, eax
cmp edx, dword [ebp - 0x18]
je 0x4e3e33
cmp edx, dword [ebp - 0x14]
je 0x4e3e3b
mov ecx, edx
not ecx
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jae 0x4e3e4a
push 0xfffffffffffffff9
pop ecx
test ecx, ecx
je 0x4e3e2a
mov esi, dword [ebx + ecx*4 + 0x1c]
mov eax, dword [edi + ecx*4]
mov dword [ebx + ecx*4 + 0x1c], eax
mov dword [edi + ecx*4], esi
inc ecx
jmp 0x4e3e15
inc edx
add ebx, 0x1c
add edi, 0xffffffe4
jmp 0x4e3dfc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov edx, ecx
push 0x6c3514
call fcn.0043a050
mov edx, dword [ebp - 0x10]
push 0x6c3524
call fcn.0043a050