joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13d0
call fcn.004b8b20
mov eax, dword [0x537700]
xor eax, esp
mov dword [esp + 0x13cc], eax
mov eax, dword [esp + 0x13d4]
mov dword [esp], eax
call fcn.004b76a3
mov dword [esp + 0x13c8], 0xffffffff
mov edx, 1
mov dword [esp + 0x48], eax
nop dword [eax + eax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [esp + edx*4 + 0x48], eax
inc edx
cmp edx, 0x270
jb 0x432160
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
mov ebp, dword [esp + 0x13e8]
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x270
mov dword [esp + 0x54], ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
test ebp, ebp
je 0x432347
nop dword [eax]
cmp ebx, 0x270
jne 0x432201
lea eax, [esp + 0x5c]
mov esi, ebx
nop
mov edx, dword [eax]
lea eax, [eax + 4]
xor edx, dword [eax - 8]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x4321c0
mov ebx, dword [esp + 0x54]
jmp 0x4322e0
cmp ebx, 0x4e0
jb 0x4322e0
xor edx, edx
nop
mov eax, dword [esp + edx*4 + 0xa18]
mov ecx, dword [esp + edx*4 + 0xa1c]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esp + edx*4 + 0x104c]
xor eax, ecx
mov dword [esp + edx*4 + 0x58], eax
inc edx
cmp edx, 0xe3
jb 0x432210
mov edx, 0xe3
nop word [eax + eax]
mov eax, dword [esp + edx*4 + 0xa18]
mov ecx, dword [esp + edx*4 + 0xa1c]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esp + edx*4 - 0x334]
xor eax, ecx
mov dword [esp + edx*4 + 0x58], eax
inc edx
cmp edx, 0x26f
jb 0x432260
mov ecx, dword [esp + 0x13d4]
mov eax, dword [esp + 0x58]
and ecx, 0x80000000
and eax, 0x7fffffff
or ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, ecx
xor eax, dword [esp + 0x688]
xor ebx, ebx
mov dword [esp + 0xa14], eax
mov dword [esp + 0x54], ebx
mov esi, dword [esp + ebx*4 + 0x58]
mov eax, esi
shr eax, 0xb
inc ebx
and eax, dword [esp + 0x13d8]
xor esi, eax
mov dword [esp + 0x54], ebx
mov eax, esi
and eax, 0xff3a58ad
shl eax, 7
xor esi, eax
mov eax, esi
and eax, 0xffffdf8c
shl eax, 0xf
xor esi, eax
mov eax, esi
shr eax, 0x12
xor esi, eax
mov eax, 0x8421085
mul esi
mov ecx, esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov eax, ecx
shl eax, 5
sub eax, ecx
mov ecx, dword [esp + 0x10]
add eax, eax
sub esi, eax
mov al, byte [esp + esi + 0x14]
mov byte [ecx + edi], al
inc edi
cmp edi, ebp
jb 0x4321b0
mov ecx, dword [esp + 0x13dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b847a
add esp, 0x13d0
ret
Function at 0x432f40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [esp + 0x18], 0
je 0x432f67
mov ecx, dword [esi + 4]
push 0
push 0
push dword [esp + 0x24]
call fcn.00425a50
pop esi
ret 0x18
mov eax, dword [esp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x432f89
mov ecx, dword [esi + 4]
push 0
push 0x2719
push dword [esp + 0x24]
call fcn.00425a50
pop esi
ret 0x18
mov eax, dword [esp + 0x14]
push ebx
push edi
mov edi, dword [esp + 0x24]
push 0
push edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x432fcf
mov eax, 0x2746
jmp 0x432fdc
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x432ffb
cmp eax, 0x3e5
je 0x432ffb
push dword [esp + 0x20]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00425a50
pop edi
pop ebx
pop esi
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00425b80
pop edi
pop ebx
pop esi
ret 0x18
Function at 0x433010
Capabilities:
Get socket status

Disassembly:
sub esp, 0x124
mov eax, dword [0x537700]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x130]
push ebx
mov ebx, dword [esp + 0x144]
push ebp
mov ebp, dword [esp + 0x130]
mov dword [esp + 8], eax
cmp ebp, 0xffffffff
jne 0x4330b4
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x43305e
cmp eax, 0xb2ab117a
je 0x43306d
cmp ecx, 0x257edfd0
jne 0x433071
cmp eax, 0xb2ab117a
jne 0x433071
mov al, 1
jmp 0x433085
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
mov dword [ebx], 0x2719
add eax, 2
mov dword [ebx + 4], 0x537028
mov dword [ebx + 8], eax
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.004b847a
add esp, 0x124
ret
cmp byte [esp + 0x144], 0
je 0x4330ef
test byte [esp + 0x134], 0x10
je 0x4330ef
xorps xmm0, xmm0
xor eax, eax
movq qword [ebx], xmm0
pop ebp
mov dword [ebx + 8], 0
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.004b847a
add esp, 0x124
ret
push esi
push edi
push ebx
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push eax
push ebp
call fcn.00428f30
add esp, 0x14
test eax, eax
jns 0x433282
test byte [esp + 0x13c], 1
jne 0x433280
mov edi, dword [0x537030]
mov esi, dword [0x537034]
cmp edi, 0x257edfd1
jne 0x43313c
cmp esi, 0xb2ab117a
je 0x43314c
cmp edi, 0x257edfd0
jne 0x433150
cmp esi, 0xb2ab117a
jne 0x433150
mov al, 1
jmp 0x433170
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x537034]
mov edi, dword [0x537030]
movzx eax, al
add eax, 2
mov dword [esp + 0x20], 0x2733
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push ebx
mov dword [esp + 0x2c], 0x537028
call fcn.00414ed0
add esp, 8
test al, al
jne 0x433204
cmp edi, 0x257edfd1
jne 0x4331ac
cmp esi, 0xb2ab117a
je 0x4331bc
cmp edi, 0x257edfd0
jne 0x4331c0
cmp esi, 0xb2ab117a
jne 0x4331c0
mov al, 1
jmp 0x4331d4
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x14], 0x4d5
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x20], 0x537028
call fcn.00414ed0
add esp, 8
test al, al
je 0x433280
push 0
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x38], ebp
push eax
push 0
lea eax, [ebp + 1]
mov dword [esp + 0x3c], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x43325d
push ebx
push dword [esp + 0x14c]
xorps xmm0, xmm0
push dword [esp + 0x14c]
movq qword [ebx], xmm0
push dword [esp + 0x1c]
mov dword [ebx + 8], 0
push ebp
call fcn.00428f30
add esp, 0x14
test eax, eax
js 0x433120
jmp 0x433282
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x1c]
call fcn.00402f30
movq xmm0, qword [eax]
movq qword [ebx], xmm0
mov eax, dword [eax + 8]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b847a
add esp, 0x124
ret
Function at 0x435770
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x34]
push edi
mov ecx, dword [esi + 8]
cmp ecx, 1
je 0x435786
mov eax, dword [esi]
jmp 0x43579a
mov eax, dword [esi + 4]
xor edx, edx
mov ebx, 0x1ffff7
div ebx
imul eax, edx, 0x3e8
add eax, dword [esi]
cmp eax, 0x40
jne 0x4357f6
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x4357b9
cmp eax, 0xb2ab117a
je 0x4357c8
cmp ecx, 0x257edfd0
jne 0x4357cc
cmp eax, 0xb2ab117a
jne 0x4357cc
mov al, 1
jmp 0x4357e0
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2745
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov dword [esi], 0x2745
add ecx, 2
mov dword [esi + 4], 0x537028
mov dword [esi + 8], ecx
test cl, 1
je 0x43580d
cmp ecx, 1
jne 0x43597a
cmp dword [esi], 0
jne 0x43597a
cmp dword [esp + 0x2c], 0
je 0x4358e1
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x4358e1
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x44], 0
push eax
mov eax, dword [esp + 0x38]
push eax
push eax
push 0
push dword [esp + 0x40]
call sub.MSWSOCK.dll_GetAcceptExSockaddrs
mov eax, dword [esp + 0x38]
cmp eax, dword [ebx]
jbe 0x4358ca
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x43588b
cmp eax, 0xb2ab117a
je 0x43589a
cmp ecx, 0x257edfd0
jne 0x43589e
cmp eax, 0xb2ab117a
jne 0x43589e
mov al, 1
jmp 0x4358b2
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2726
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
mov dword [esi], 0x2726
add eax, 2
mov dword [esi + 4], 0x537028
mov dword [esi + 8], eax
jmp 0x4358e1
push eax
push dword [esp + 0x10]
push dword [esp + 0x34]
call fcn.004ba120
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x435950
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x43590c
cmp eax, 0xb2ab117a
je 0x43591b
cmp ecx, 0x257edfd0
jne 0x43591f
cmp eax, 0xb2ab117a
jne 0x43591f
mov al, 1
jmp 0x435933
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2719
movzx eax, al
mov dword [esi + 4], 0x537028
add eax, 2
pop edi
mov dword [esi + 8], eax
pop esi
pop ebx
add esp, 0x10
ret
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0x700b
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setne al
movzx eax, al
push eax
push esi
call fcn.00424970
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43a070
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x43a09e
mov ecx, dword [edi + 4]
push 0
push 0x2719
push dword [esp + 0x28]
call fcn.00425a50
pop edi
ret 0x1c
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x24]
push esi
push 0
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push dword [esp + 0x28]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x43a10c
cmp eax, 0x3e5
je 0x43a10c
push dword [esp + 0x10]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00425a50
pop esi
pop ebx
pop edi
ret 0x1c
mov ecx, dword [edi + 4]
push ebx
call fcn.00425b80
pop esi
pop ebx
pop edi
ret 0x1c
Function at 0x43a650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7365
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x537700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test al, 1
je 0x43a6df
cmp eax, 1
jne 0x43a68e
cmp dword [esi], 0
je 0x43a6df
push dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.0043cb50
movq xmm0, qword [esi]
mov eax, dword [esi + 8]
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi]
add eax, 0x44
push eax
call fcn.0043c890
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.004125d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov ecx, dword [eax]
lea ebx, [eax + 4]
mov dword [ebp - 0x10], ecx
lea ecx, [eax + 0x44]
mov eax, dword fs:[0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [0x53c078]
mov esi, dword [eax + ecx*4]
cmp byte [esi + 0xc], 0
jne 0x43a712
call fcn.004b89f4
mov eax, dword [esi + 4]
test eax, eax
je 0x43a721
mov eax, dword [eax + 4]
jmp 0x43a723
xor eax, eax
push 4
push 0x90
push eax
push dword [ebp + 8]
call fcn.0040ac00
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx]
xorps xmm0, xmm0
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x40]
movq qword [esi + 0x20], xmm0
push edi
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x444280
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x423f50
mov byte [esi + 0x3c], 0
call fcn.0043cb50
push dword [ebp + 0x10]
lea ecx, [esi + 0x74]
push 0
push 0
call fcn.0040e9b0
mov eax, dword [ebp + 0xc]
mov edx, 0x1c
push esi
push esi
mov ecx, 0x10
mov dword [ebp - 0x14], esi
cmp word [eax], 2
cmovne ecx, edx
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push 1
push dword [ebx + 0x1c]
add ecx, 0x14
push ebx
call fcn.00429770
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.00444f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x444ba0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x444bc6
mov eax, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
cmp dword [esp + 4], 0
jg 0x444bd5
jl 0x444bb1
cmp dword [esp], 0
jbe 0x444bb1
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x444c01
nop word [eax + eax]
inc esi
cmp esi, 3
ja 0x444c4c
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x444bf0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.004b8cc0
mulsd xmm0, qword [0x4f39c0]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.004b8cc0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.004b8bc0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
Function at 0x44c020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x537700]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4c], ebx
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0x44dd60
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
movq qword [ebx + 0x20], xmm0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov al, byte [edx + 8]
mov byte [ebx + 0x38], al
mov eax, dword [edx + 0xc]
mov dword [ebx + 0x3c], eax
mov eax, dword [edx + 0x10]
mov dword [ebx + 0x40], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0xc], 0
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], 0
je 0x44c0e7
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
call eax
jmp 0x44c0ec
mov eax, 0x538514
add eax, 4
push 0x538a54
push eax
call fcn.004ba7fa
add esp, 8
test eax, eax
jne 0x44c13b
mov dword [ebp - 0x20], eax
lea ecx, [ebx + 0x48]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x14], 0x4f01e8
call fcn.0040df00
cmp dword [ebp - 0x1c], 0
mov byte [ebp - 4], 3
je 0x44c1b2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call eax
add esp, 4
jmp 0x44c1b2
cmp dword [edi + 0x10], 0
je 0x44c1d2
mov eax, dword [edi + 0x18]
push edi
mov esi, dword [eax + 0x2c]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0xc]
call eax
lea ecx, [ebp - 0x4a]
push ecx
push eax
lea eax, [ebp - 0x68]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x48]
push eax
call fcn.0040df00
cmp dword [ebp - 0x58], 0
mov byte [ebp - 4], 1
je 0x44c186
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x68]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0
push eax
lea ecx, [ebx + 0x48]
call fcn.0040df00
cmp dword [ebp - 0x38], 0
mov byte [ebp - 4], 2
je 0x44c1ae
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
lea eax, [ebp - 0x48]
push eax
call ecx
add esp, 4
mov byte [ebp - 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b847a
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x74]
call fcn.00410f40
lea eax, [ebp - 0x74]
push eax
call fcn.0040d240
int3
Function at 0x44e360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5f15
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x537700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test al, 1
je 0x44e3ef
cmp eax, 1
jne 0x44e39e
cmp dword [esi], 0
je 0x44e3ef
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.0042c720
movq xmm0, qword [esi]
mov eax, dword [esi + 8]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi]
add eax, 0x44
push eax
call fcn.0044ee60
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.0042d370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov ecx, dword [eax]
lea ebx, [eax + 4]
mov dword [ebp - 0x10], ecx
lea ecx, [eax + 0x44]
mov eax, dword fs:[0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [0x53c078]
mov esi, dword [eax + ecx*4]
cmp byte [esi + 0xc], 0
jne 0x44e422
call fcn.004b89f4
mov eax, dword [esi + 4]
test eax, eax
je 0x44e431
mov eax, dword [eax + 4]
jmp 0x44e433
xor eax, eax
push 8
push 0x98
push eax
push dword [ebp + 8]
call fcn.0040ac00
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx]
xorps xmm0, xmm0
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x40]
movq qword [esi + 0x20], xmm0
push edi
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x451640
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x423f50
mov byte [esi + 0x3c], 0
call fcn.0042c720
push dword [ebp + 0x10]
lea ecx, [esi + 0x78]
push 0
push 0
call fcn.0040e9b0
mov eax, dword [ebp + 0xc]
mov edx, 0x1c
push esi
push esi
mov ecx, 0x10
mov dword [ebp - 0x14], esi
cmp word [eax], 2
cmovne ecx, edx
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push 1
push dword [ebx + 0x1c]
add ecx, 0x14
push ebx
call fcn.00429770
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.004327d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x455f20
Capabilities:
Get common file path

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x455f59
push esi
push dword [esp + 0xc]
push dword [esp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x456470
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x230
push 0xffffffffffffffff
push 0x4e938d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x537700]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4564e8
push 0x4f5314
push 0x53be98
call fcn.00455600
add esp, 8
jmp 0x45651f
lea eax, [ebp]
mov dword [ebp], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x456518
mov edi, dword [ebp + 0x238]
mov eax, dword [ebp + 0x18]
cmp eax, dword [edi]
je 0x456543
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x456503
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.004b847a
lea esp, [ebp + 0x230]
pop ebp
ret
mov eax, dword [ebp + 8]
jmp 0x456521

Function at 0x456550
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004ba6a0
add esp, 0xc
lea eax, [esp]
xorps xmm0, xmm0
movups xmmword [esp], xmm0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x78]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esp, 0x54
ret

Function at 0x456590
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
push 0x40
lea eax, [esp + 8]
mov dword [esp + 4], 0x44
push 0
push eax
call fcn.004ba6a0
add esp, 0xc
lea eax, [esp]
push dword [esp + 0x50]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x6c]
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esp, 0x44
ret
Function at 0x456b90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
cmp dword [esp + 0x14], 0
mov eax, dword [esp + 8]
push ebx
push ebp
mov bh, byte [eax]
lea ebp, [eax + 2]
mov cl, byte [eax + 1]
jbe 0x456bfc
push esi
push edi
mov edi, dword [esp + 0x20]
mov al, cl
sub dword [esp + 0x1c], edi
inc bh
lea edi, [edi + 1]
movzx esi, bh
mov bl, byte [esi + ebp]
add al, bl
movzx edx, al
movzx ecx, byte [edx + ebp]
mov byte [esi + ebp], cl
mov byte [edx + ebp], bl
movzx edx, byte [esi + ebp]
movzx ecx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [esp + 0x1c]
movzx ecx, byte [ecx + ebp]
xor cl, byte [edx + edi - 1]
sub dword [esp + 0x24], 1
mov byte [edi - 1], cl
jne 0x456bb2
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x18]
mov cl, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [eax], bh
mov byte [eax + 1], cl
pop ebx
pop ecx
ret

Function at 0x456c10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
mov edx, 0x100
lea esi, [edi + 2]
mov word [edi], 0
mov ecx, esi
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jb 0x456c30
mov ebp, 0xfffffffe
mov dword [esp + 0x18], 0
sub ebp, edi
mov dword [esp + 0x10], edx
nop
lea eax, [esi + ebp]
mov bl, byte [esi]
xor edx, edx
lea esi, [esi + 1]
div dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edx + eax]
movzx eax, bl
add cx, ax
mov eax, 0xff
add cx, word [esp + 0x18]
and cx, ax
sub dword [esp + 0x10], 1
movzx eax, cx
movzx ecx, ax
mov dword [esp + 0x18], eax
mov al, byte [ecx + edi + 2]
mov byte [esi - 1], al
mov byte [ecx + edi + 2], bl
jne 0x456c50
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret