joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407628
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4076b8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4076b8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40766b
test edx, 3
jne 0x40765a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x407665
jmp 0x40766b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40766b
cmp dword [ecx - 8], 1
je 0x407675
mov edx, ebx
or edx, 3
call fcn.00404b78
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x407687
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044ac

Function at 0x4076c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x407754
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x407754
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x407707
test edx, 3
jne 0x4076f6
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x407701
jmp 0x407707
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x407707
cmp dword [ecx - 8], 1
je 0x407711
mov edx, ebx
or edx, 3
call fcn.00404b78
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x407723
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044ac

Function at 0x407e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040494c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407e19
test al, 0x10
je 0x407e1d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x407e24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040494c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407e3d
test al, 0x10
jne 0x407e41
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a734
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a76d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040459c
jmp 0x40a776
mov eax, ebx
mov edx, esi
call fcn.00404500
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a780
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a7a2
movzx eax, byte [esp]
jmp 0x40a7a4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ae34
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40acac
mov eax, dword [0x43a740]
cmp byte [eax], 0
je 0x40aeb0
mov eax, dword [0x43a638]
call fcn.00402fc4
call fcn.00402d4c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407fd4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40aef8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40aee6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x43a610]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x43d7f8]
call fcn.0040585c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x41c6cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040493c
lea eax, [ebp - 8]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x41c79e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d9c
push eax
call sub.ntdll_RtlDosPathNameToNtPathName_U
push 0
push 0
push 0
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x34]
mov ecx, 0x40
call fcn.0041c69c
push 0
push 0
push 0x20
push 2
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x100002
lea eax, [ebp - 0xc]
push eax
call sub.ntdll_NtCreateFile
mov esi, dword [ebp - 4]
test esi, esi
je 0x41c756
sub esi, 4
mov esi, dword [esi]
push 0
push 0
push esi
lea eax, [ebp - 4]
call fcn.004049a4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.ntdll_NtWriteFile
mov eax, dword [ebp - 0xc]
push eax
call sub.ntdll_NtClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c7a5
lea eax, [ebp - 8]
call fcn.00404c0c
lea eax, [ebp - 4]
call fcn.004044ac
ret

Function at 0x41c7b0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x41c880
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044ac
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
push eax
call sub.ntdll_RtlDosPathNameToNtPathName_U
push 0
push 0
push 0
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, 0x40
call fcn.0041c69c
push 0x20
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
call sub.ntdll_NtOpenFile
push 5
push 0x18
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtQueryInformationFile
mov esi, dword [ebp - 0x40]
mov eax, ebx
mov edx, esi
call fcn.00404b78
push 0
push 0
push esi
mov eax, ebx
call fcn.004049a4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtReadFile
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c887
lea eax, [ebp - 4]
call fcn.00404c0c
ret
Function at 0x41cef8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x41cf00
push ebx
push esi
mov ebx, eax
mov esi, dword [0x43a658]
xor eax, eax
push ebp
push 0x41d05e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41d078
push dword [esi]
push 0x41d084
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 8]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 4]
call fcn.004046a4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x10]
mov edx, 0x41d078
call fcn.00404798
mov eax, dword [ebp - 0x10]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004046a4
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00417dec
push 0x41d078
push dword [esi]
push 0x41d098
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 0x18]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004046a4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x20]
mov edx, 0x41d078
call fcn.00404798
mov eax, dword [ebp - 0x20]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004046a4
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00417dec
push 0x41d078
push dword [esi]
push 0x41d0ac
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 0x28]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.004046a4
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x30]
mov edx, 0x41d078
call fcn.00404798
mov eax, dword [ebp - 0x30]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004046a4
mov eax, dword [ebp - 0x2c]
pop edx
call fcn.00417dec
push 0
push 1
mov eax, ebx
call fcn.0040494c
push eax
call sub.wininet_InternetCheckConnectionA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d065
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.004044d0
ret

Function at 0x41d2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040493c
mov eax, dword [ebp - 8]
call fcn.0040493c
mov eax, dword [ebp + 8]
call fcn.0040493c
xor eax, eax
push ebp
push 0x41d36f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x43e644
mov eax, dword [ebp - 4]
call fcn.0040494c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d315
sub eax, 4
mov eax, dword [eax]
mov dword [0x43e648], eax
mov eax, dword [0x43e648]
push eax
lea eax, [ebp + 8]
call fcn.004049a4
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040494c
push eax
mov eax, dword [0x43e644]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x43e644]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d376
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044d0
lea eax, [ebp + 8]
call fcn.004044ac
ret
Function at 0x41d3ec
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x41d40b
add edx, 3
sar edx, 2
test edx, edx
jle 0x41d519
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x41d440
je 0x41d483
sub ecx, 0x2b
je 0x41d479
sub ecx, 4
je 0x41d47e
dec ecx
sub ecx, 0xa
jb 0x41d46b
jmp 0x41d486
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x41d452
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x41d45d
jmp 0x41d486
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x41d486
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x41d486
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x41d486
mov byte [eax], 0x3e
jmp 0x41d486
mov byte [eax], 0x3f
jmp 0x41d486
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x41d423
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x41d4d7
cmp byte [esp + 7], 0xff
jne 0x41d4d7
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x41d50e
cmp dl, 0xff
je 0x41d50e
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x41d41a
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4150a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x4150c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4150c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4150b8
mov eax, 1
add ebx, ebx
jne 0x4150db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4150d0
jne 0x4150ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4150d0
xor ecx, ecx
sub eax, 3
jb 0x415100
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415172
mov ebp, eax
add ebx, ebx
jne 0x41510b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415118
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41513c
inc ecx
add ebx, ebx
jne 0x415128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41511d
jne 0x415139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41511d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41515c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41514d
jmp 0x4150be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41515c
add edi, ecx
jmp 0x4150be
pop esi
mov edi, esi
mov ecx, 0x3df
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41517a
cmp byte [edi], 1
jne 0x41517a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41517f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x4151f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x168a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16984]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4151ac
mov ecx, edi
jns 0x4151db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16988]
or eax, eax
je 0x4151f1
mov dword [ebx], eax
add ebx, 4
jmp 0x4151c9
call dword [esi + 0x16998]
mov ebp, dword [esi + 0x1698c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41522b
sub esp, 0xffffff80
jmp 0x40a850

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401390
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x4013c3
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x4013ab
neg eax
shr eax, 0x1f
pop edi
pop esi
ret

Function at 0x44c240
Capabilities:
Reference opendns dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2010
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x64b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
test edi, edi
je 0x44c321
push 0x400
call fcn.005b122b
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44c321
push 0x3fc
lea ecx, [ebx + 4]
push 0
push ecx
call fcn.005aebe0
mov esi, dword [reloc.WS2_32.dll_inet_addr]
add esp, 0xc
mov dword [ebx], 2
push str.208.67.222.222
call esi
push str.208.67.220.220
mov dword [ebx + 4], eax
call esi
mov esi, dword [0x5d30a0]
push 0
mov dword [ebx + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x142
push 5
push edi
call esi
test eax, eax
jne 0x44c2e6
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x18]
push 0
lea eax, [ebp + 8]
push eax
push ebx
push 0x142
push 1
push edi
call esi
test eax, eax
jne 0x44c321
mov esi, dword [ebp + 8]
nop
test esi, esi
je 0x44c316
mov ecx, dword [esi + 0x18]
call fcn.0044c0a0
mov esi, dword [esi]
jmp 0x44c300
push 1
push dword [ebp + 8]
call dword [0x5d30a4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x455700
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi]
lea ecx, [esi + 8]
mov ebx, dword [esi + 4]
mov dword [ebp - 4], ecx
test edx, edx
je 0x455769
mov edx, dword [ebp + 0xc]
sub dword [ebp + 8], edx
mov esi, dword [ebp - 4]
lea eax, [edi + 1]
movzx edi, al
lea edx, [edx + 1]
mov cl, byte [ecx + edi]
movzx eax, cl
add eax, ebx
movzx ebx, al
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov byte [esi + edi], al
add al, cl
mov byte [esi + ebx], cl
mov ecx, esi
movzx eax, al
movzx eax, byte [eax + ecx]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + edx - 1]
mov ecx, esi
sub dword [ebp - 8], 1
mov byte [edx - 1], al
jne 0x455726
mov esi, dword [ebp - 0xc]
mov dword [esi], edi
xor eax, eax
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45eee0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0x45ef16
mov al, byte [esi]
push eax
call fcn.0046af80
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x45eef8
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x46a000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.0046a040
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.005c8080

Function at 0x46bef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46bf11
cmp dword [esi + 0x80], 0
je 0x46bf11
push 2
push 3
push esi
call fcn.0046b520
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0046b950
add esp, 4
test esi, esi
je 0x46bf34
cmp dword [esi + 0x80], 0
je 0x46bf34
push 3
push esi
call fcn.0046b560
add esp, 8
pop esi
pop ebp
ret
Function at 0x478750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.005bfee4
add esp, 0x18
test eax, eax
je 0x478772
cmp eax, 0xffffffff
jne 0x478774
xor eax, eax
pop ebp
ret

Function at 0x479140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x64b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x64fca4], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x158], ebx
jne 0x479176
call fcn.0047c040
test al, al
je 0x479187
mov byte [0x64fca4], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456b8b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x9c0]
test eax, eax
je 0x4791a8
push 0x400
push eax
call fcn.004a8ed0
add esp, 8
call fcn.0047c040
test al, al
jne 0x479176
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [ebp - 0x150], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], eax
nop
lea eax, [ebp - 0x188]
push eax
call fcn.0046b5a0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x178], xmm0
movups xmmword [ebp - 0x168], xmm0
call fcn.0046af50
lea eax, [ebp - 0x198]
push eax
call fcn.0046b5a0
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.0046b5a0
add esp, 0x10
mov ecx, eax
mov eax, esi
inc ebx
cdq
mov dword [ebp - 0x154], ebx
add eax, dword [ecx]
push 0
adc edx, dword [ecx + 4]
push ebx
push edx
push eax
call fcn.005cf850
movups xmm1, xmmword [ebp - 0x178]
mov esi, dword [ebp - 0x148]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.005cf850
xor edi, eax
xor ebx, edx
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x168], edi
push eax
mov dword [ebp - 0x164], ebx
call fcn.0046b5a0
lea esi, [eax + 8]
lea eax, [ebp - 0x1c8]
push eax
call fcn.0046b5a0
mov edx, dword [ebp - 0x148]
add esp, 8
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x154]
add ecx, dword [eax]
lea eax, [edx + 2]
mov dword [ebp - 0x148], ebx
imul edx, dword [ebp - 0x160]
imul ecx, eax
mov eax, dword [ebp - 0x14c]
shl ecx, 0x10
xor ecx, edx
mov dword [ebp - 0x160], ecx
movups xmm0, xmmword [ebp - 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x150], 1
mov dword [ebp - 0x14c], eax
jne 0x4791d0
movsd xmm0, qword [0x5d8478]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.004a8170
add esp, 0x10
call fcn.0047c040
test al, al
je 0x4791b0
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.004a8d10
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x479354
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.004a8ed0
add esp, 8
call fcn.0047c040
test al, al
jne 0x479176
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x158]
call fcn.00467d20
add esp, 8
call fcn.0047c040
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456b8b
mov esp, ebp
pop ebp
ret