joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c554
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
push esi
mov ecx, edx
mov edx, eax
mov esi, ecx
shr esi, 2
and ecx, 3
test esi, esi
je 0x40c5db
je 0x40c60a
mov eax, 0xffffffff
xor ebx, ebx
mov dword [esp], edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x59b0c0]
movzx edi, byte [edx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x59b0c0]
movzx edi, byte [edx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x59b0c0]
movzx edi, byte [edx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x59b0c0]
add edx, 4
inc ebx
cmp ebx, esi
jb 0x40c577
mov edi, dword [esp]
jmp 0x40c5e0
mov eax, 0xffffffff
test ecx, ecx
je 0x40c604
je 0x40c604
xor ebx, ebx
inc edx
movzx esi, byte [edx - 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x59b0c0]
inc ebx
cmp ebx, ecx
jb 0x40c5e8
not eax
pop ecx
pop ebx
pop esi
ret
mov eax, 0xffffffff
jmp 0x40c5e0

Function at 0x40c618
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
lea edx, [esp]
push 8
push edx
push dword [eax]
call fcn.0046fd28
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret
Function at 0x40d55c
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], edx
mov eax, dword [eax]
inc dword [0x834738]
mov edi, ecx
xor esi, esi
xor esi, ecx
cmp ecx, 4
jl 0x40d59d
imul ebp, dword [edx], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul ebx, ebp, 0x5bd1e995
imul esi, esi, 0x5bd1e995
xor esi, ebx
add edx, 4
add edi, 0xfffffffc
cmp edi, 4
jge 0x40d577
cmp edi, 3
je 0x40d5ae
cmp edi, 2
je 0x40d5b7
cmp edi, 1
je 0x40d5c0
jmp 0x40d5cb
movzx edi, byte [edx + 2]
shl edi, 0x10
xor esi, edi
movzx edi, byte [edx + 1]
shl edi, 8
xor esi, edi
movzx edx, byte [edx]
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edx, esi
shr edx, 0xd
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edi, esi
shr edi, 0xf
xor esi, edi
and esi, 0x7fffffff
add esi, 0x80000000
test eax, eax
je 0x40d62e
mov edi, dword [0x834734]
mov ebx, eax
mov ebp, ecx
inc edi
mov dword [0x834734], edi
cmp esi, dword [ebx + 0x1c]
jne 0x40d625
cmp ebp, dword [ebx + 0x18]
jne 0x40d61f
push ebp
mov edx, dword [esp + 4]
push edx
push dword [ebx + 0x14]
call fcn.004702b0
add esp, 0xc
test eax, eax
je 0x40d634
inc dword [0x834730]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x40d5f9
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4177dc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x59b710]
cmp eax, 0x270
jl 0x4178aa
xor edx, edx
mov eax, dword [edx*4 + 0x5ce760]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5ce764]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5ced94]
xor ecx, dword [eax*4 + 0x577538]
mov dword [edx*4 + 0x5ce760], ecx
inc edx
cmp edx, 0xe3
jl 0x4177ee
cmp edx, 0x26f
jge 0x417876
mov eax, dword [edx*4 + 0x5ce760]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5ce764]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5ce3d4]
xor ecx, dword [eax*4 + 0x577538]
mov dword [edx*4 + 0x5ce760], ecx
inc edx
cmp edx, 0x26f
jl 0x417836
mov edx, dword [0x5cf11c]
and edx, 0x80000000
mov eax, dword [0x5ce760]
and eax, 0x7fffffff
or edx, eax
mov ecx, edx
shr ecx, 1
xor ecx, dword [0x5ced90]
and edx, 1
xor ecx, dword [edx*4 + 0x577538]
mov dword [0x5cf11c], ecx
xor eax, eax
lea edx, [eax + 1]
mov dword [0x59b710], edx
mov eax, dword [eax*4 + 0x5ce760]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
Function at 0x425840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x28
mov ebx, eax
test ebx, ebx
je 0x425905
movsx edx, byte [0x59b714]
test edx, edx
je 0x425861
mov eax, ebx
call fcn.00425914
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x425905
mov edx, dword [eax + 0x30]
mov ecx, dword [eax + 0x34]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x38]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x40]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x48]
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov esi, ebx
mov ebx, eax
mov eax, esi
lea edx, [esp + 8]
call fcn.004110a4
mov edx, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x74]
add dword [esp + 8], edx
adc dword [esp + 0xc], ecx
mov edx, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x7c]
add dword [esp + 0x10], edx
adc dword [esp + 0x14], ecx
mov edx, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x74]
add dword [esp + 0x18], edx
adc dword [esp + 0x1c], ecx
mov edx, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x7c]
add dword [esp + 0x20], edx
adc dword [esp + 0x24], ecx
mov esi, dword [esi + 0x10]
cmp esi, dword [0x83441c]
je 0x4258fd
mov ebx, dword [esi + 0x44]
test ebx, ebx
jne 0x4258a8
xor eax, eax
add esp, 0x28
pop ebx
pop esi
ret
mov eax, 0xffffffff
add esp, 0x28
pop ebx
pop esi
ret
Function at 0x4391d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x58
mov edi, dword [esp + 0x78]
test eax, eax
je 0x43939c
mov ebx, dword [eax + 0x44]
test edx, edx
je 0x439395
mov esi, dword [edx + 0x44]
mov eax, ecx
cdq
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, edi
cdq
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov ecx, dword [ebx + 0x88]
mov dword [esp + 0x14], ecx
mov edi, dword [ebx + 0x8c]
mov dword [esp + 0x18], edi
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x88]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x8c]
mov dword [esp + 0x30], eax
lea eax, [esp + 4]
call fcn.00406524
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
mov byte [esi + 0xa8], 1
movsx ecx, word [ebx + 0xa2]
cmp ecx, 0x100
je 0x439310
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
movsx ecx, word [ebx + 0xa2]
movsx edi, word [esi + 0xa2]
mov dword [esp + 0x54], edi
cmp dword [esp + 0x4c], 0
jle 0x439306
xor edi, edi
mov ebp, ebx
mov ebx, ecx
jmp 0x4392a5
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x40]
add ecx, ecx
add ecx, ecx
add ecx, dword [esi + 0xc0]
imul edx, dword [esi + 0x88]
add edx, edx
add edx, edx
add ecx, edx
mov edx, dword [esp + 0x38]
add edx, edx
add edx, edx
add edx, dword [ebp + 0xc0]
imul eax, dword [ebp + 0x88]
add eax, eax
add eax, eax
add edx, eax
mov eax, dword [esp + 0x48]
add eax, eax
add eax, eax
push eax
push ebx
mov eax, dword [esp + 0x5c]
push eax
push edx
push ecx
call dword [0x5b85c4]
add esp, 0x14
mov edx, dword [esp + 0x44]
inc edx
mov eax, dword [esp + 0x3c]
inc eax
inc edi
cmp edi, dword [esp + 0x4c]
jl 0x43929d
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
movsx ecx, word [esi + 0xa2]
cmp dword [esp + 0x4c], 0
jle 0x439306
xor edi, edi
mov ebp, ecx
jmp 0x439334
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x40]
add ecx, ecx
add ecx, ecx
add ecx, dword [esi + 0xc0]
imul edx, dword [esi + 0x88]
add edx, edx
add edx, edx
add ecx, edx
mov edx, dword [esp + 0x38]
add edx, edx
add edx, edx
add edx, dword [ebx + 0xc0]
imul eax, dword [ebx + 0x88]
add eax, eax
add eax, eax
add edx, eax
mov eax, dword [esp + 0x48]
add eax, eax
add eax, eax
push eax
push ebp
push edx
push ecx
call dword [0x5b85c0]
add esp, 0x10
mov edx, dword [esp + 0x44]
inc edx
mov eax, dword [esp + 0x3c]
inc eax
inc edi
cmp edi, dword [esp + 0x4c]
jl 0x43932c
jmp 0x439306
xor esi, esi
jmp 0x4391f9
xor ebx, ebx
jmp 0x4391ee
Function at 0x439d01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x4c
mov ebp, eax
test ebp, ebp
je 0x439f4e
mov ebx, dword [ebp + 0x44]
movsx ecx, cl
test ecx, ecx
je 0x439d1e
mov ebp, edx
mov edx, dword [ebp + 0x44]
mov dword [esp + 0x3c], edx
mov eax, ebp
call fcn.00410fe8
mov edi, dword [esp + 0x6c]
neg edi
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x74]
neg ecx
mov esi, dword [ebx + 0x88]
mov edx, dword [esp + 0x70]
lea edx, [edx + esi - 1]
mov dword [esp + 0x44], edx
mov eax, dword [ebx + 0x8c]
mov esi, dword [esp + 0x78]
lea esi, [esi + eax - 1]
mov dword [esp + 0x38], esi
sub edx, edi
lea edi, [edx + 1]
mov dword [esp + 0x48], edi
sub esi, ecx
inc esi
test edi, edi
jle 0x439e7d
test esi, esi
jle 0x439e7d
lea eax, [edx*4 + 4]
cmp edi, 0x2000
jg 0x439f11
imul eax, esi
lea edx, [eax + edx*4 + 8]
push edx
mov dword [esp + 0x38], ecx
call fcn.0046f65c
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [esp + 0x30], eax
mov edx, eax
test edx, edx
je 0x439ed6
mov edx, esi
imul edx, dword [esp + 0x48]
add edx, edx
add edx, edx
push dword [0x59b770]
push edx
mov edi, dword [esp + 0x38]
push edi
mov dword [esp + 0x40], ecx
call dword [0x5b8568]
mov ecx, dword [esp + 0x40]
add esp, 0xc
mov edx, dword [esp + 0x6c]
test edx, edx
jle 0x439e9c
mov edx, dword [esp + 0x3c]
mov byte [edx + 0xa8], 1
mov edx, dword [esp + 0x30]
test edx, edx
je 0x439e8f
mov dword [esp + 0xc], ecx
mov edi, dword [esp + 0x44]
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + 0x88]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0x8c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x30]
mov edx, dword [ebx + 0xc0]
mov ecx, dword [esp + 0x40]
call fcn.00439f64
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
call fcn.00433a44
mov eax, ebp
call fcn.00410fe8
xor eax, eax
add esp, 0x4c
pop ebx
pop ebp
pop esi
pop edi
ret
push 0x83b6b0
push 0x83a2b0
call fcn.00409034
add esp, 8
mov eax, 0xffffffff
add esp, 0x4c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 0x70]
test edx, edx
jg 0x439de9
mov edx, dword [esp + 0x74]
test edx, edx
jg 0x439de9
mov edx, dword [esp + 0x78]
test edx, edx
jg 0x439de9
movzx edx, byte [ebx + 0xa8]
mov edi, dword [esp + 0x3c]
mov byte [edi + 0xa8], dl
jmp 0x439df4
push esi
mov edx, edi
push edx
push 0
push 0x83b68c
push 0x83a2b0
mov dword [esp + 0x48], ecx
call fcn.0046d5d8
mov ecx, dword [esp + 0x48]
push 0
push 1
push 0x1965e
mov dword [esp + 0x54], ecx
call fcn.0046c71c
mov ecx, dword [esp + 0x54]
add esp, 0x20
jmp 0x439db5
push esi
mov edx, edi
push edx
push 0x83b664
push 0x83a2b0
mov dword [esp + 0x44], ecx
call fcn.00409034
mov ecx, dword [esp + 0x44]
push 1
push 0x186aa
mov dword [esp + 0x4c], ecx
call fcn.0046c778
mov ecx, dword [esp + 0x4c]
add esp, 0x18
xor edx, edx
mov dword [esp + 0x30], edx
jmp 0x439db5
xor ebx, ebx
jmp 0x439d15
Function at 0x440914
Capabilities:
Read file on windows

Disassembly:
push esi
lea edx, [esp]
push 1
push edx
push dword [eax]
call fcn.0046fd28
movsx eax, byte [esp + 0xc]
add esp, 0x10
ret
Function at 0x451414
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov dword [esp], eax
xor ecx, ecx
xor ecx, edx
cmp edx, 4
jl 0x45144d
imul ebp, dword [eax], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul esi, ebp, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 4
jge 0x451427
cmp edx, 3
je 0x45145e
cmp edx, 2
je 0x451467
cmp edx, 1
je 0x451470
jmp 0x45147b
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov edx, ecx
shr edx, 0xd
xor ecx, edx
imul edx, ecx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x18
mov eax, dword [ecx*4 + 0x793c60]
mov ecx, dword [0x8347e0]
mov dword [esp + 4], ecx
cmp eax, ecx
jge 0x4514f2
mov ecx, dword [0x8347e4]
mov ebx, eax
mov ebp, edx
mov esi, dword [ecx + ebx*4]
cmp ebp, dword [esi + 4]
jne 0x4514e9
mov edi, dword [esi]
mov esi, dword [esp]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4514e0
or dl, dl
je 0x4514dc
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4514e0
add edi, 2
add esi, 2
or dl, dl
jne 0x4514c0
xor eax, eax
jmp 0x4514e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4514ff
inc ebx
mov esi, dword [esp + 4]
cmp ebx, esi
jl 0x4514b3
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x464d50
Capabilities:
Read file on windows

Disassembly:
push esi
lea edx, [esp]
push 4
push edx
push dword [eax]
call fcn.0046fd28
mov eax, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x464d6c
Capabilities:
Read file on windows

Disassembly:
push edi
push ebx
sub esp, 0x24
mov edi, eax
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x464d85
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x464d7d
mov ebx, eax
inc ebx
push ebx
call fcn.0046f65c
pop ecx
mov ecx, dword [0x83459c]
mov edx, dword [0x834598]
mov dword [edx + ecx*4], eax
mov edx, dword [0x834598]
mov ecx, dword [0x83459c]
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x464ee1
push ebx
push edi
push edx
call dword [0x5b856c]
add esp, 0xc
mov ebx, dword [0x83459c]
mov ecx, dword [0x834598]
lea eax, [esp + 8]
mov edx, dword [ecx + ebx*4]
call fcn.00464f54
movsx eax, byte [esp + 0x10]
test eax, eax
je 0x464ebc
lea eax, [esp + 0x20]
push 4
push eax
push dword [esp + 0x10]
call fcn.0046fd28
add esp, 0xc
lea eax, [esp + 8]
call fcn.00464d50
mov edi, eax
lea eax, [esp + 8]
call fcn.00464d50
mov ebx, eax
lea eax, [esp + 8]
call fcn.00464fe4
mov edx, dword [esp + 0x20]
cmp edx, 0x465059
jne 0x464e5a
cmp edi, 0x22b
je 0x464e34
cmp edi, 0xea
jl 0x464e97
mov edx, dword [0x8345a0]
add edx, ebx
mov dword [0x8345a0], edx
cmp edx, 0x30d40
jge 0x464e7b
mov eax, dword [0x83459c]
inc eax
mov dword [0x83459c], eax
cmp eax, 0x64
jge 0x464e62
xor eax, eax
add esp, 0x24
pop ebx
pop edi
ret
push 0x64
push 1
push 0x196c2
call fcn.0046c71c
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
push 0x30d40
push 1
push 0x196cc
call fcn.0046c71c
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
mov edx, dword [0x83459c]
mov eax, dword [0x834598]
push dword [eax + edx*4]
push 1
push 0x196b8
call fcn.0046c71c
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
mov edx, dword [0x83459c]
mov eax, dword [0x834598]
push dword [eax + edx*4]
push 1
push 0xdbfb0
call fcn.0046c71c
mov eax, 0xfffffffe
add esp, 0x30
pop ebx
pop edi
ret
push 1
push 0x186aa
call fcn.0046c778
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop edi
ret

Function at 0x464fd0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edx
push dword [eax]
call fcn.0046fd28
add esp, 0xc
ret

Function at 0x4656d8
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push 0x418950
call fcn.0047146c
add esp, 0xc
test eax, eax
je 0x4656fe
movsx edx, byte [0x59b734]
dec edx
push edx
push eax
call dword [0x5770c0]
ret
push 0x83ac4c
push 0
call fcn.00409034
add esp, 8
ret
Function at 0x46a980
Capabilities:
Create thread

Disassembly:
movsx eax, byte [0x83431c]
test eax, eax
je 0x46a99c
xor eax, eax
push eax
push eax
push 0x41d0ac
call fcn.0047146c
add esp, 0xc
ret

Function at 0x46a9a0
Capabilities:
Create thread

Disassembly:
push edi
push esi
push ebx
push esi
movsx edx, byte [0x59b730]
test edx, edx
jle 0x46aa3b
xor eax, eax
xor ecx, ecx
xor edx, edx
mov edi, eax
mov ebx, edx
mov esi, ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [0x5770e0]
mov dword [esi*4 + 0x79d680], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [0x5770e0]
mov dword [ebx + 0x79d780], eax
xor eax, eax
push eax
push 1
push eax
push eax
call dword [0x5770e0]
mov dword [ebx + 0x79d880], eax
cmp dword [esi*4 + 0x79d680], 0
je 0x46ab01
cmp dword [esi*4 + 0x79d780], 0
je 0x46aaf1
cmp dword [esi*4 + 0x79d880], 0
je 0x46aae1
add ebx, 4
inc esi
movsx edx, byte [0x59b730]
cmp esi, edx
jl 0x46a9bf
mov eax, edi
cmp eax, 1
je 0x46aac9
test edx, edx
jle 0x46aac5
xor eax, eax
xor ecx, ecx
xor edx, edx
mov ebx, eax
mov esi, edx
mov edi, ecx
mov dword [esi + 0x79bd80], edi
xor ecx, ecx
lea edx, [esi + 0x79bd80]
lea eax, [esp]
push eax
push ecx
push edx
push 0x41bc04
push ecx
push ecx
call fcn.00472a1d
add esp, 0x18
mov dword [edi*4 + 0x79bc80], eax
push edi
push eax
call dword [0x5770c0]
cmp dword [edi*4 + 0x79bc80], 0
jne 0x46aa90
mov ebx, 1
add esi, 0x64
inc edi
movsx eax, byte [0x59b730]
cmp edi, eax
jl 0x46aa4f
mov eax, ebx
cmp eax, 1
je 0x46aaad
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
ret
push 0x83b52c
push 0
call fcn.00409034
mov eax, 0xffffffff
add esp, 0xc
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x46aaa1
push 0x83b500
push 0
call fcn.00409034
mov eax, 0xffffffff
add esp, 0xc
pop ebx
pop esi
pop edi
ret
call dword [0x577290]
mov edi, 1
jmp 0x46aa21
call dword [0x577290]
mov edi, 1
jmp 0x46aa13
call dword [0x577290]
mov edi, 1
jmp 0x46aa05
Function at 0x46c2d0
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
call dword [0x577460]
test eax, eax
jg 0x46c2e4
mov dword [0x833fd8], eax
xor eax, eax
pop ecx
ret
mov edx, 0x10
cmp eax, 0x10
jl 0x46c2f0
mov eax, edx
mov dword [0x833fd8], eax
xor eax, eax
mov dword [esp], ebx
mov ebx, eax
lea edx, [ebx + 0x7930a0]
push 0x34
push edx
call dword [0x5b8560]
add esp, 8
mov dword [ebx + 0x7930a0], 0x34
mov dword [ebx + 0x7930a4], 0x83
add ebx, 0x34
cmp ebx, 0x340
jl 0x46c2fc
mov ebx, dword [esp]
mov dword [0x7933e0], 1
mov dword [0x7933e4], 2
mov dword [0x7933e8], 4
mov dword [0x7933ec], 8
mov dword [0x7933f0], 0x10
mov dword [0x7933f4], 0x20
mov dword [0x7933f8], 0x40
mov dword [0x7933fc], 0x80
mov dword [0x793400], 0x100
mov dword [0x793404], 0x200
mov dword [0x793408], 0x400
mov dword [0x79340c], 0x800
mov dword [0x793410], 0x1000
mov dword [0x793414], 0x2000
mov dword [0x793418], 0x4000
mov dword [0x79341c], 0x8000
mov dword [0x793420], 0x10000
mov dword [0x793424], 0x20000
mov dword [0x793428], 0x40000
mov dword [0x79342c], 0x80000
mov dword [0x793430], 0x100000
mov dword [0x793434], 0x200000
mov dword [0x793438], 0x400000
mov dword [0x79343c], 0x800000
mov dword [0x793440], 0x1000000
mov dword [0x793444], 0x2000000
mov dword [0x793448], 0x4000000
mov dword [0x79344c], 0x8000000
mov dword [0x793450], 0x10000000
mov dword [0x793454], 0x20000000
mov dword [0x793458], 0x40000000
mov dword [0x79345c], 0x80000000
mov eax, 1
pop ecx
ret

Function at 0x46c9d4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x5ce760], eax
mov eax, 1
mov ecx, dword [eax*4 + 0x5ce75c]
mov edx, ecx
shr edx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5ce760], edx
inc eax
cmp eax, 0x270
jl 0x46c9e2
mov dword [0x59b710], eax
ret
Function at 0x495198
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
je 0x495246
cmp eax, 0xcb
je 0x4951db
cmp eax, 0xcc
je 0x4951d1
push ebx
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov ecx, dword [ebx]
mov edx, dword [ebx + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [ebx]
call dword [eax]
pop ecx
mov eax, ebx
call fcn.00495278
pop ecx
pop ebx
ret
mov edx, dword [ebx + 0x190]
movzx ecx, byte [edx + 0x10]
test ecx, ecx
jne 0x4951f4
mov edx, dword [ebx + 0x7c]
mov dword [ebx + 0x84], edx
jmp 0x4951d1
mov edx, dword [ebx + 8]
test edx, edx
je 0x4951ff
push ebx
call dword [edx]
pop ecx
push ebx
mov edx, dword [ebx + 0x190]
call dword [edx]
pop ecx
test eax, eax
je 0x495270
cmp eax, 2
je 0x4951e9
mov edx, dword [ebx + 8]
test edx, edx
je 0x4951ff
cmp eax, 3
je 0x495223
cmp eax, 1
jne 0x4951fb
mov ecx, dword [edx + 4]
add ecx, 1
mov dword [edx + 4], ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx + 8]
cmp ecx, eax
jl 0x4951f7
mov ecx, dword [ebx + 0x11c]
add eax, ecx
mov dword [edx + 8], eax
mov edx, dword [ebx + 8]
jmp 0x4951f7
push ebx
call fcn.00497fd0
pop ecx
movzx edx, byte [ebx + 0x40]
test edx, edx
jne 0x495261
mov dword [ebx + 0x14], 0xcb
jmp 0x4951db
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ecx
pop ebx
ret
xor eax, eax
pop ecx
pop ebx
ret

Function at 0x495278
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
sub esp, 8
mov ebx, eax
mov edx, dword [ebx + 0x14]
cmp edx, 0xcc
je 0x4952a1
push ebx
mov edx, dword [ebx + 0x180]
call dword [edx]
pop ecx
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x14], 0xcc
mov edx, dword [ebx + 0x180]
movzx ecx, byte [edx + 8]
test ecx, ecx
je 0x49533a
mov eax, dword [ebx + 0x78]
mov dword [esp], esi
mov dword [esp + 4], edi
lea ecx, [ebx + 0x78]
mov esi, ecx
jmp 0x4952c6
xor eax, eax
cmp eax, dword [ebx + 0x60]
jae 0x49530e
mov edx, dword [ebx + 8]
test edx, edx
je 0x4952e8
push ebx
mov dword [edx + 4], eax
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0x60]
mov dword [edx + 8], eax
mov edi, dword [ebx + 8]
call dword [edi]
pop ecx
mov eax, dword [ebx + 0x78]
mov edx, dword [ebx + 0x184]
mov edi, eax
xor eax, eax
push eax
push esi
push eax
push ebx
call dword [edx + 4]
add esp, 0x10
mov eax, dword [ebx + 0x78]
cmp eax, edi
je 0x49535b
cmp eax, dword [ebx + 0x60]
jb 0x4952cb
mov edx, dword [ebx + 0x180]
push ebx
call dword [edx + 4]
push ebx
mov eax, dword [ebx + 0x180]
call dword [eax]
add esp, 8
mov edx, dword [ebx + 0x180]
mov dword [ebx + 0x78], 0
movzx eax, byte [edx + 8]
test eax, eax
jne 0x4952c4
mov esi, dword [esp]
mov edi, dword [esp + 4]
movzx edx, byte [ebx + 0x41]
test edx, edx
je 0x495349
mov edx, 0xce
jmp 0x49534e
mov edx, 0xcd
mov dword [ebx + 0x14], edx
mov eax, 1
add esp, 8
pop ebx
ret
mov esi, dword [esp]
mov edi, dword [esp + 4]
xor eax, eax
add esp, 8
pop ebx
ret
Function at 0x499dac
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push edi
push esi
push ebp
sub esp, 0x20
mov edi, eax
mov esi, dword [edi + 0x1a8]
mov edx, dword [edi + 0x4c]
cmp edx, 1
je 0x499f01
mov byte [esi + 0x1c], 0
xor ebp, ebp
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
lea edx, [ebp + 0x100]
push edx
push 1
push edi
call dword [ecx + 8]
add esp, 0x10
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov edx, dword [edi + 0x64]
test edx, edx
jle 0x499efa
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp], ebx
xor edx, edx
mov ebx, eax
mov dword [esp + 4], edx
jmp 0x499e13
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + 0x18]
mov edi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [edi + ebp*4 + 0x20]
mov eax, ecx
cdq
idiv edi
lea ebp, [ebp + ebp]
test esi, esi
mov ecx, eax
je 0x499e40
mov edx, dword [esp + 0xc]
add dword [ebx + ebp*2], 0xff
mov ebx, dword [edx + 0x18]
mov ebp, dword [ebx + ebp*2]
lea ebx, [edi + edi - 2]
mov dword [esp + 0x1c], ebx
lea eax, [edi + 0xfe]
cdq
idiv ebx
xor esi, esi
mov edx, eax
xor eax, eax
mov ebx, eax
mov eax, edi
mov edi, edx
cmp esi, edi
jle 0x499e9c
mov dword [esp + 0x18], eax
mov edx, ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x1c]
shl edx, 9
sub edx, ebx
sub edx, ebx
lea edi, [eax + edx + 0xfe]
add edi, 0x1fe
add ebx, 1
mov eax, edi
cdq
idiv ecx
cmp esi, eax
jg 0x499e80
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov edx, ecx
imul edx, ebx
mov byte [esi + ebp], dl
add esi, 1
cmp esi, 0xff
jle 0x499e60
mov edx, dword [esp + 8]
test edx, edx
je 0x499edf
mov ebx, 1
movzx edx, byte [ebp]
mov esi, ebp
sub esi, ebx
mov byte [esi], dl
movzx edx, byte [ebp + 0xff]
mov byte [ebx + ebp + 0xff], dl
add ebx, 1
cmp ebx, 0xff
jle 0x499ebc
mov edx, dword [esp + 4]
mov ebx, dword [esp + 0x10]
add edx, 1
cmp edx, dword [ebx + 0x64]
mov dword [esp + 4], edx
jl 0x499e0c
mov ebx, dword [esp]
add esp, 0x20
pop ebp
pop esi
pop edi
ret
mov byte [esi + 0x1c], 1
mov ebp, 0x1fe
jmp 0x499dcc