joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444810
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x444843
push esi
call fcn.00447920
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44483c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4448c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4448b2
mov eax, dword [esi + 8]
test eax, eax
je 0x444867
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4448ae
cmp eax, 2
je 0x4448b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44485a
cmp eax, 3
je 0x44488d
cmp eax, 1
jne 0x44485a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44485a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44485a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004448f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4448d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004448f0
add esp, 4
pop esi
ret

Function at 0x463c32
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463c6a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461c71
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461c49
jmp 0x463c76
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465329
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46536b
call fcn.0046b3b9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46536b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465362
xor eax, eax
jmp 0x465373
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465379
pop edi
pop esi
pop ebx
ret 4

Function at 0x46aaa8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46aad6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46aaf4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046aa0e
jmp 0x46aaf4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46aaf4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046aa0e
test edi, edi
mov eax, edi
jne 0x46aade
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405307
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a640]
jne 0x405311
repz ret
jmp fcn.00407aed

Function at 0x40686c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004031ae
and dword [ebp - 4], 0
cmp dword [0x41b734], 0
mov ebx, eax
jne 0x40691d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4069ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4069ce
push eax
call fcn.0040313c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41b734], eax
call esi
push eax
call fcn.0040313c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41b738], eax
call esi
push eax
call fcn.0040313c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41b73c], eax
call esi
push eax
call fcn.0040313c
pop ecx
mov dword [0x41b744], eax
test eax, eax
je 0x40691d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040313c
pop ecx
mov dword [0x41b740], eax
mov eax, dword [0x41b740]
cmp eax, ebx
je 0x406975
cmp dword [0x41b744], ebx
je 0x406975
push eax
call fcn.004031b7
push dword [0x41b744]
mov esi, eax
call fcn.004031b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406975
test edi, edi
je 0x406975
call esi
test eax, eax
je 0x40696c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40696c
test byte [ebp - 0xc], 1
jne 0x406975
or dword [ebp + 0x10], 0x200000
jmp 0x4069ae
mov eax, dword [0x41b738]
cmp eax, ebx
je 0x4069ae
push eax
call fcn.004031b7
pop ecx
test eax, eax
je 0x4069ae
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4069ae
mov eax, dword [0x41b73c]
cmp eax, ebx
je 0x4069ae
push eax
call fcn.004031b7
pop ecx
test eax, eax
je 0x4069ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b734]
call fcn.004031b7
pop ecx
test eax, eax
je 0x4069ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4069d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4165a0
Capabilities:
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
cmp dword [0x5d53390], 0xa76
jne 0x416692
lea eax, [ebp - 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 0x1d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
lea edx, [ebp - 0xb8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_OpenFile]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
xor eax, eax
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x5d0]
push ecx
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov edx, dword [0x5d53394]
mov ecx, dword [0x5d529a8]
mov al, byte [edx + esi + 0xa2401]
mov byte [ecx + esi], al
mov esp, ebp
pop ebp
ret
Function at 0x416930
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [0x5d53390]
push edi
mov edi, dword [0x5d529a8]
cmp esi, 0x124b
jne 0x416955
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x5d53390], 0xc00
jne 0x416983
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shr esi, 3
test esi, esi
jbe 0x416a48
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
lea ecx, [ecx]
cmp dword [0x5d53390], 0xec9
jne 0x4169de
xor eax, eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3c]
push edx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call esi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x5d53390], 0xe1b
jne 0x4169f4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
cmp dword [0x5d53390], 0x43e
jne 0x416a12
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
call fcn.004166b0
cmp dword [0x5d53390], 0xe60
jne 0x416a3b
xor ecx, ecx
lea edx, [ebp - 4]
push edx
push ecx
xor eax, eax
push ecx
mov word [ebp - 4], ax
mov word [ebp - 2], cx
call sub.KERNEL32.dll_SetConsoleDisplayMode
add edi, 8
sub dword [ebp - 8], 1
jne 0x4169a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x405091
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x405091
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x452fdb
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push 0x1e
mov eax, ecx
pop edx
sub eax, edx
je 0x452ff7
dec eax
je 0x452ff2
dec eax
je 0x452fee
xor eax, eax
jmp 0x452ffa
push 0x27
jmp 0x452ff9
push 0x1a
pop edi
jmp 0x452ffc
push 0xd
pop eax
mov edi, eax
cmp dword [ebp - 0x3c], 0
mov ebx, dword [ebp - 8]
je 0x45305b
lea edx, [ebx - 2]
mov ax, word [edx]
and ax, word [ebp - 0x12c]
cmp ax, word [ebp - 0x148]
jne 0x45305b
mov ax, word [edx]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
movzx ebx, word [ebx - 2]
push 0x1e
pop eax
cmp cx, ax
ja 0x418115
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x50], eax
jle 0x418115
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x5c], ebx
mov eax, dword [eax + 0x68]
or eax, dword [ebp - 0x8c]
mov dword [ebp - 0x54], eax
jmp 0x418115

Function at 0x45b1e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
call 0x40ad1004
cld
rcr byte [ecx - 0x7b], 1
sal byte [esp + ecx - 0x75], cl
dec ebx
add al, 0x8b
or al, 0xb9
mov ecx, dword [ecx]
mov dword [edx], ecx
pop es
xor eax, 0x4684d2fc
add al, 0x6a
add al, 0x59
mov dword [eax + edi*4], edx
inc edi
cmp edi, dword [esi + 8]
jb 0x45b1bb
pop edi
push es
invalid

Function at 0x462913
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xfc
mov dword [edi - 0x73], edx
mov ecx, 0x4689833b
cmp dword [edi], 0
je 0x462959
mov eax, dword [ecx + 0x5e200644]
dec bp
inc esi
add al, 0x8b
xor byte [ebx + 0x18906], cl
pcmpeqb mm1, qword [esi]
add al, 0x85
idiv byte [ebp - 0x5c7af7b]
dec edi
call fcn.00404699
mov ebp, 0x34e8c008
sbb eax, 0x2583fffa
clc
jle 0x46299e
or byte [eax], al
add byte [esi + 0x5e], dl
jmp 0x462989
cmp byte [ecx + 0xf137400], 0
jne 0x462987
cmp dword [0x367dc], 0
push ebp
adc al, 0xa1
clc
jle 0x4629bb
or byte [ebx + 0xa7d64f8], al
inc eax
mov dword [0x84c7ef8], eax
push 0xffffffffffffffe8
inc edx
sub dword [edx + 0xa], 0xffffff8b
in al, dx
push ecx
push ebx
push edi
mov edi, edi
dec esi
dec dword [esi + 8]
int1
or cl, dh
push 0x344b1000
call 0x83d1dd78
rcl byte [edi - 0x75]
jge 0x4629d7
push es
lea eax, [ecx + 4]
jge 0x4629df
push 0x18
call 0x9421012
add byte [ebx - 0x38fff39a], al
or cl, byte [ebp + 0x2de8084e]
dec esi
cli
inc dword [ebx - 0xc]
invalid
push 7
pop edi
cmp edi, eax
jg 0x462a2b
lea ecx, [ebx - 0x7bf0ffe6]
in al, dx
xor eax, dword [ecx + 0x74]
or byte [edi + 4], al
test esi, esi
cmp edi, eax
jle 0x4629ec
cmp edi, eax
jg 0x462a2b
push 0x18
call 0x9421012
add byte [ebx - 0x38fff39a], al
or cl, byte [ebp - 0x2f17f7b2]
dec ebp
cli
inc dword [ebx - 0xc]
invalid
or eax, 0x105f72b0
Function at 0x487e02
Capabilities:
Encrypt data using speck

Disassembly:
salc
mov word [edi + 0x39490088], ax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x1b0], eax
mov al, 1
pop edi
xor dword [ebp - 0x75], 0xffffffe5
je 0x487e6b
adc al, 0
ror byte [ebx + 0x18458bf1], cl
cmp eax, 0xffffffff
jne 0x487e2c
push 4
pop eax
test al, 0xc
jne 0x487e33
or eax, 4
push ebx
test dword [edi - 0x7d], edx
enter 0x5002, 0xffffffffffffffe8
mov dword [edx], edi
pop es
push ds
xor esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ecx
inc ebp
jne 0x487e59
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push 0x4bb828
push ebx
push esi
call fcn.00401d51
idiv edi
mov edi, eax
test edi, edi
je 0x487ef0
push dword [ebp + 0x14]
call fcn.00423f95
pop ecx
call fcn.0043b5ec
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp + 0x18]
push ecx
push eax
stc
call [ecx - 0x18]
jns 0x487ea8
sti
dec dword [ebp - 0x72aeefb3]
dec ebp
sbb byte [ecx + 0x50], dl
mov ecx, 0x4c67b0
call 0x4640241e
in al, 0
je 0x487ee9
mov ecx, dword [ebp + 0x18]
mov eax, dword [0xdb4c6810]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax]
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x487ee9
mov edx, dword [ebp + 0x10]
mov eax, dword [0xdb4c6824]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp byte [eax + 0x46b00490], 3
jne 0x487ee9
mov ebp, dword [eax + 0xc]
mov esi, dword [0xfe28f688]
push ebx
mov dword [ecx], edi
mov eax, dword [0xdb4c6824]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
mov eax, dword [eax]
push eax
push 0x469
push edi
mov dword [ecx + 0x34], eax
call esi
push 0x80017fff
push ebx
push 0x465
push edi
call esi
mov al, 1
jmp 0x487ef2
push edi
push dword [edi + 0x3c]
imul byte [eax]
invalid
xor al, al
pop edi
xor dword [ebp + 0x74], 0x4f
adc al, 0
Function at 0x48e485
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, 0x5050705
add eax, 0x5050505
add eax, 0x5050505
pop es
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050705
add eax, 0x5050505
add eax, 0x5050505
or byte [0xe050505], al
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
or dword [ecx], ecx
or dword [0xa050505], eax
add dword [eax], eax
les eax, [0xb010505]
or ecx, dword [ebx]
or ecx, dword [esp + ecx]
or al, 5
or al, 5
add eax, 0x505050c
add eax, 0x1010105
add eax, 0x505050c
add eax, 0x1010105
add dword [ecx], eax
add eax, 0x10d0505
or eax, 0xd010d01
add dword [ecx], eax
dec esp
or al, 1
add eax, 0x51f18bd2
push ebx
jg 0x48e433
fst dword [edi - 0x75]
cli
mov esi, dword [ebx]
cmp esi, edi
ja 0x490153
mov dword [ebp - 4], 0x80
mov eax, esi
mov ecx, 0x80
cdq
idiv ecx
movzx eax, byte [eax + 0x4b3b40]
shl eax, 7
add eax, edx
movzx ecx, word [eax*2 - 0x24b5a7c0]
movzx eax, byte [ecx*8 + 0x4a2f53]
push esi
jmp 0x48e55b

Function at 0x48e541
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [eax], ecx
xor eax, eax
jmp 0x48e556
pop edi
push 0x56
mov ebx, ecx
mov eax, ebx
ror byte [ebx + 0x50ec83f1], cl
mov bh, byte [edi + 7]
psubw mm1, qword [ebx - 0x7827626]
mov esi, dword [edi]
add esi, 2
movzx eax, word [esi]
cmp dl, 0x74
xor edx, edx
mov dword [ebx], edx
cmp eax, 0x7b
jne 0x48e5cd
cmp word [esi + 2], 0x5e
jne 0x48e593
mov dword [ebx], 1
add esi, 2
mov eax, edx
add esi, 2
movzx ecx, word [esi]
test cx, cx
je 0x48e5b0
cmp ecx, 0x7d
je 0x48e5c4
mov word [ebp + eax*2 - 0x50], cx
inc eax
cmp eax, 0x1f
jl 0x48e595
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x3949002e
xor eax, eax
mov dword [edi], esi
pop edi
push 0x56
mov ebx, ecx
mov eax, ebx
xor ecx, ecx
mov word [ebp + eax*2 - 0x50], cx
jmp 0x48e5d7
mov word [ebp - 0x50], ax
xor eax, eax
mov word [ebp - 0x4e], ax
mov eax, 0xa9
mov dword [edi], esi
mov dword [ebp - 0xc], eax
lea ecx, [eax + edx]
lea eax, [ebp - 0x50]
sar ecx, 1
mov dword [ebp - 4], eax
imul eax, ecx, 6
movzx ebx, word [eax + 0x4b8f80]
add ebx, 0x1e4b8a20
xor eax, dword [ebp - 4]
movzx edi, word [eax]
test di, di
jne 0x48e60c
cmp byte [ebx], 0
je 0x48e658
movzx edi, word [eax]
add eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
inc ebx
mov dword [ebp - 0x10], edi
cmp di, ax
mov edi, dword [ebp - 8]
je 0x48e5fc
cmp ax, word [ebp - 0x10]
sbb eax, eax
neg eax
lea eax, [eax*2 - 1]
cmp dl, 0x74
and dword [esi + 8], edi
mov eax, dword [ebp - 0xc]
lea edx, [ecx + 1]
jmp 0x48e646
cmp edx, eax
jl 0x48e5e1
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x1c2f
jmp 0x48e5b9
imul esi, ecx, 6
xor eax, eax
mov ecx, dword [ebp + 8]
or byte [eax + 0xf], al
mov bh, 0x96
or byte [edi + 0x1189004b], 0x8b
dec ebp
or al, 0xf
mov bh, 0x96
test byte [edi + 0x1189004b], cl
Function at 0x48eae6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp esi, dword [ebp + 8]
jbe 0x48eaf2
cmp word [esi - 2], 0xd
je 0x48eaf5
lea edi, [edx + 1]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
lea eax, [edx + 1]
pop edi
xor dword [ebp + 0x74], 0xffffffc3
jne 0x48eb11
lea eax, [ebx - 0x74acf314]
fidiv dword [ebx]
rcl byte [esi + 0x42], cl
push edi
movzx eax, word [ebx]
mov bh, 3
mov edi, ecx
movzx esi, al
and esi, edx
mov dword [ebp - 4], eax
cmp edi, 0x100
jae 0x48eb6b
test al, 4
jne 0x48eb48
test al, 2
je 0x64eeae
and ecx, 7
shr edi, 3
shl dl, cl
push 0
pop eax
test byte [edi + ebx + 2], dl
setne al
jmp 0x64eeb0
test al, 2
je 0x48eb6b
mov eax, edi
and ecx, 7
shr eax, 3
shl edx, cl
test byte [eax + ebx + 2], dl
je 0x48eb68
xor eax, eax
test esi, esi
sete al
jmp 0x48eeb0
mov eax, dword [ebp - 4]
push 2
pop ecx
add ebx, ecx
and al, cl
je 0x48eb77
add ebx, 0x20
movzx ecx, word [ebx]
test cx, cx
je 0xfc47eeae
mov eax, edi
mov dword [ebp - 4], 0x80
cdq
idiv dword [ebp - 4]
mov dword [ebp - 0xc], 0x46b00403
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
add ebx, 2
inc eax
push 2
cmp cx, ax
pop eax
jne 0x48ebef
movzx ecx, word [ebx]
add ebx, eax
cmp dword [ebp + 8], 0
je 0x48ebe2
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x48ebe2
movzx eax, word [ebx]
and ecx, 0x1e0703ff
and eax, 0x1e0703ff
shl ecx, 0xa
or ecx, eax
push 2
pop eax
add ecx, 0x74010000
add ebx, eax
cmp edi, ecx
je 0xff5deb5c
jmp 0x4633eea2
cmp cx, ax
jne 0x74a3ec7b
movzx ecx, word [ebx]
add ebx, eax
cmp dword [ebp + 8], 0
je 0x48ec61
mov eax, ecx
and eax, 0xfc00
push 2
cmp eax, 0xd800
jne 0x48ec2f
movzx eax, word [ebx]
mov edx, 0x1e0703ff
and ecx, edx
and eax, edx
shl ecx, 0xa
or ecx, eax
pop eax
add ecx, 0x74010000
add ebx, eax
jmp 0x48ec30
pop eax
movzx edx, word [ebx]
add ebx, eax
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x48ec66
movzx eax, word [ebx]
and edx, 0x1e0703ff
and eax, 0x1e0703ff
shl edx, 0xa
or edx, eax
push 2
add edx, 0x74010000
pop eax
jmp 0x48ec64
movzx edx, word [ebx]
add ebx, eax
cmp edi, ecx
jb 0x74a3ee9f
cmp edi, edx
jbe 0xff5deb5c
jmp 0x4633ee9f
je 0x490b03
cmp edi, 0x50452066
jb 0x48ee91
cmp edi, 0x50452069
jbe 0x48ef03
xor eax, eax
inc eax
cmp eax, edx
je 0xff5deb5c
add ebx, 4
mov edx, dword [ebp - 4]
movzx ecx, word [ebx]
test cx, cx
jne 0xff5deb9d
mov eax, esi
push esi
push 0x56
mov ebx, ecx
mov eax, ebx
mov cl, byte [eax*8 + 0x4a2f51]
cmp cl, 0x1b
je 0x48ef03
cmp cl, 0x1c
je 0x48ef03
movzx eax, cl
cmp dword [eax*4 + 0x4b89a0], 0
jne 0x48ee91
cmp cl, 1
jne 0x48ef03
cmp edi, 0x61c
jmp 0x48ee7b
xor eax, eax
jmp 0x48ee94
add byte [ecx], cl
push edi
add byte [edx], dl
dec ecx
add byte [eax + eax + 0x45], dl
add byte [eax], al
add byte [eax], al
add byte [ecx], cl
dec ecx
add byte [esi], cl
dec ecx
add byte [edi], dl
push edx
add byte [ecx], cl
push esp
add byte [ebp], al
push ebx
add byte [ebp], al
inc ebx
add byte [eax + eax + 0x49], dl
add byte [edi], cl
dec esi
add byte [eax], al
add byte [ecx], cl
dec ecx
add byte [esi], cl
push eax
add byte [ebp], dl
push esp
add byte [edx], al
dec edi
add byte [eax], bl
add byte [eax], al
add byte [eax], al
dec ecx
add byte [esi], cl
push esp
add byte [eax], al
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402c00
pop dword [ebp - 0x2c]
mov eax, 0xefec424c
sub eax, 0xefac164c
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1f667ac1
add dword [ebp - 0x3c], 0x2eebca8a
mov dword [ebp - 0x38], 0x3448c259
add dword [ebp - 0x38], 0xfdea89ec
mov dword [ebp - 0x34], 0xb75506a6
add dword [ebp - 0x34], 0x94f73d88
mov dword [ebp - 0x30], 0x7b1d016
sub dword [ebp - 0x30], 0x7b1d016
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x2a79f7de
sub eax, 0x2a39877a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xac4d14ac
add dword [ebp - 0x3c], 0xc82554aa
mov dword [ebp - 0x38], 0x7f2328d2
sub dword [ebp - 0x38], 0x3db6c75d
mov dword [ebp - 0x34], 0x33a3a94e
add dword [ebp - 0x34], 0x2fcbc31e
mov dword [ebp - 0x30], 0x93ff10f7
add dword [ebp - 0x30], 0x6c00ef09
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xcff4be88
sub eax, 0xcfb44de0
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x356ea
push 0
call eax
mov ecx, 0x42f9
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x2c]
mov esi, 0xff07c75
sub esi, 0xa8a3ba63
xor dword [ebp - 0x1c], 0xa15ae71e
mov edx, dword [ebx]
add edx, esi
xor dword [ebp - 0x14], 0x371e59fc
mov dword [edi], edx
xor dword [ebp - 0x10], 0x3bf25d8f
add edi, 0x7e31057c
add edi, 0x81cefa88
add ebx, 4
loop 0x402d16
add eax, 0xfcc02ad7
add eax, 0x340d3e0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb1f3207d
sub ecx, 0xb1b3207d
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret