joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x51e1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x51e1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x51edff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0051ef04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0051ef20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0051eeec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0051ef04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0051eecb
push ecx
push dword [ebp + 8]
call fcn.0051ef04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0051ef04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0051eecb
push ecx
push dword [ebp + 8]
call fcn.0051ef04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0051ef04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0051eecb
push ecx
push dword [ebp + 8]
call fcn.0051ef04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0051ef04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0051eecb
cmp ecx, 0x2b
jne 0x51ee0f
leave
ret 0xc

Function at 0x5204b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x520544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0xc7830
push 0
call dword [eax + 0x20]
test eax, eax
je 0x5205d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0xc7830
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0xc7830
call fcn.005203fa
push 0xc7830
push dword [ebp + 0xc]
call fcn.0051e1a8
test eax, eax
jne 0x5205b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0xc7830
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.005205dd
test eax, eax
je 0x5205d6
jmp 0x520574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x5205d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x52060b
Capabilities:
Terminate process

Disassembly:
call fcn.00520618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x405d80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4511c8
push eax
mov dword fs:[0], esp
push esi
mov edx, dword [esp + 0x20]
lea esi, [ecx + 0x64]
xor ecx, ecx
and edx, 0xff
mov ch, byte [esp + 0x28]
mov eax, dword [esi]
mov cl, byte [esp + 0x24]
mov dword [esp + 0xc], 0
shl ecx, 8
or ecx, edx
push ecx
mov ecx, esi
call dword [eax + 0x30]
push 1
mov ecx, esi
call fcn.0044a7e8
mov eax, dword [esp + 0x14]
cmp eax, 0xd
jne 0x405de2
mov eax, dword [esi]
push 0x46c158
mov ecx, esi
call dword [eax + 0x28]
jmp 0x405e35
cmp eax, 0xf
jne 0x405df0
mov edx, dword [esi]
push 0x46c168
jmp 0x405e30
cmp eax, 0xc
jne 0x405e03
mov eax, dword [esi]
push 0x46c170
mov ecx, esi
call dword [eax + 0x28]
jmp 0x405e35
cmp eax, 0xe
jne 0x405e11
mov edx, dword [esi]
push 0x46c160
jmp 0x405e30
cmp eax, 0x19
jne 0x405e24
mov eax, dword [esi]
push 0x46c150
mov ecx, esi
call dword [eax + 0x28]
jmp 0x405e35
cmp eax, 0x23
jne 0x405e35
mov edx, dword [esi]
push 0x46c148
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esp + 0x2c]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], 0xffffffff
call fcn.00447f5d
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 0x1c

Function at 0x408820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4514c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x454c98
mov edx, dword [esp + 0x38]
xor ecx, ecx
mov ch, byte [esp + 0x40]
and edx, 0xff
mov cl, byte [esp + 0x3c]
mov dword [esp + 0x20], eax
shl ecx, 8
or ecx, edx
push ecx
push 1
push eax
call dword [fcn.004530b8]
push eax
lea ecx, [esp + 0xc]
call fcn.0044ae5e
add esi, 0x74
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0044a773
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov edi, eax
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.0044aa63
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
mov ecx, esi
call fcn.0044aaaf
push edi
mov ecx, esi
call fcn.0044a773
lea ecx, [esp + 8]
call fcn.0044aeb5
mov dword [esp + 8], 0x454cb8
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call fcn.0044aeb5
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x1c
Function at 0x408b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
xor eax, eax
push esi
mov ah, byte [esp + 0x44]
mov esi, ecx
mov al, byte [esp + 0x40]
mov ecx, dword [esp + 0x3c]
shl eax, 8
and ecx, 0xff
or eax, ecx
lea ecx, [esp + 4]
push eax
call fcn.0044aecb
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x2c]
lea eax, [esp + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], edx
neg eax
mov edx, dword [esp + 0x38]
mov dword [esp + 0x24], 0
sbb eax, eax
mov dword [esp + 0x18], edx
and eax, ecx
mov ecx, dword [esi + 0x78]
push eax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [fcn.004534c0]
lea ecx, [esp + 4]
call fcn.0044aeb5
mov dword [esp + 4], 0x454cb8
lea ecx, [esp + 4]
mov dword [esp + 0x24], 1
call fcn.0044aeb5
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c

Function at 0x408bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [fcn.004534d4]
push eax
call fcn.0044a5ca
mov edx, dword [esp + 0x40]
xor ecx, ecx
mov ch, byte [esp + 0x48]
and edx, 0xff
mov cl, byte [esp + 0x44]
mov edi, eax
shl ecx, 8
or ecx, edx
push ecx
lea ecx, [esp + 0xc]
call fcn.0044aecb
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
neg eax
sbb eax, eax
lea ecx, [esp + 0x10]
and eax, edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
mov dword [esp + 0x34], 0
call dword [fcn.004534c0]
lea ecx, [esp + 8]
call fcn.0044aeb5
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [fcn.004534c8]
mov dword [esp + 8], 0x454cb8
lea ecx, [esp + 8]
mov dword [esp + 0x28], 1
call fcn.0044aeb5
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
Function at 0x408bd8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [fcn.004534d4]
push eax
call fcn.0044a5ca
mov edx, dword [esp + 0x40]
xor ecx, ecx
mov ch, byte [esp + 0x48]
and edx, 0xff
mov cl, byte [esp + 0x44]
mov edi, eax
shl ecx, 8
or ecx, edx
push ecx
lea ecx, [esp + 0xc]
call fcn.0044aecb
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
neg eax
sbb eax, eax
lea ecx, [esp + 0x10]
and eax, edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
mov dword [esp + 0x34], 0
call dword [fcn.004534c0]
lea ecx, [esp + 8]
call fcn.0044aeb5
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [fcn.004534c8]
mov dword [esp + 8], 0x454cb8
lea ecx, [esp + 8]
mov dword [esp + 0x28], 1
call fcn.0044aeb5
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c

Function at 0x409150
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4515e8
push eax
mov dword fs:[0], esp
push esi
mov edx, dword [esp + 0x20]
lea esi, [ecx + 0x74]
xor ecx, ecx
and edx, 0xff
mov ch, byte [esp + 0x28]
mov eax, dword [esi]
mov cl, byte [esp + 0x24]
mov dword [esp + 0xc], 0
shl ecx, 8
or ecx, edx
push ecx
mov ecx, esi
call dword [eax + 0x30]
push 1
mov ecx, esi
call fcn.0044a7e8
mov eax, dword [esp + 0x14]
cmp eax, 0xd
jne 0x4091b2
mov eax, dword [esi]
push 0x46c158
mov ecx, esi
call dword [eax + 0x28]
jmp 0x409205
cmp eax, 0xf
jne 0x4091c0
mov edx, dword [esi]
push 0x46c168
jmp 0x409200
cmp eax, 0xc
jne 0x4091d3
mov eax, dword [esi]
push 0x46c170
mov ecx, esi
call dword [eax + 0x28]
jmp 0x409205
cmp eax, 0xe
jne 0x4091e1
mov edx, dword [esi]
push 0x46c160
jmp 0x409200
cmp eax, 0x19
jne 0x4091f4
mov eax, dword [esi]
push 0x46c150
mov ecx, esi
call dword [eax + 0x28]
jmp 0x409205
cmp eax, 0x23
jne 0x409205
mov edx, dword [esi]
push 0x46c148
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esp + 0x2c]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], 0xffffffff
call fcn.00447f5d
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 0x1c
Function at 0x419480
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
mov dword [0x46cb3c], eax
push esi
mov dword [0x46cb40], eax
push edi
mov word [0x46cb44], ax
mov eax, dword [esp + 0x14]
xor ecx, ecx
lea esi, [edx + eax]
xor eax, eax
mov edi, 0xa
mov al, byte [esi + ecx]
cdq
idiv edi
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
and edx, 0xff
lea eax, [edx + 0x46cb3c]
mov dl, byte [edx + 0x46cb3c]
inc dl
inc ecx
cmp ecx, 6
mov byte [eax], dl
jl 0x4194a1
cmp dword [0x46c7d8], 1
jne 0x419522
mov ecx, dword [esp + 0xc]
mov al, byte [esi + 6]
cmp ecx, 2
mov byte [esp + 0x10], al
jne 0x4194f3
and al, 0xf
inc al
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
mov ecx, 0xa
and eax, 0xff
cdq
idiv ecx
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
and edx, 0xff
mov cl, byte [edx + 0x46cb3c]
lea eax, [edx + 0x46cb3c]
inc cl
mov byte [eax], cl
xor dl, dl
pop edi
mov byte [esp + 0xc], dl
xor ecx, ecx
pop esi
mov al, byte [ecx + 0x46cb3c]
cmp al, dl
jbe 0x419538
mov dl, al
inc ecx
cmp ecx, 0xa
jl 0x41952c
mov byte [esp + 8], dl
mov eax, dword [esp + 8]
and eax, 0xff
ret 0xc

Function at 0x428630
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x45202b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push 0x100
push eax
push esi
xor ebp, ebp
call dword [fcn.004532c8]
push eax
call dword [0x4532e8]
lea ecx, [esp + 0x18]
call fcn.004482ef
push esi
lea ecx, [esp + 0x2c]
push esi
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x13c], esi
call fcn.00448401
test eax, eax
jne 0x4286be
lea ecx, [esp + 0x18]
mov dword [esp + 0x130], 0xffffffff
call fcn.00448344
xor eax, eax
jmp 0x42873b
push 0
push esi
lea ecx, [esp + 0x20]
call fcn.004485a3
mov edx, dword [0x46c1a4]
push 0xfde8
push edx
lea ecx, [esp + 0x20]
call fcn.0044851e
mov edi, eax
add esi, eax
shr edi, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
je 0x428715
xor esi, esi
mov eax, dword [0x46c1a4]
push esi
push eax
mov ecx, ebx
call fcn.00420710
xor eax, 0x52618a9f
add esi, 4
add ebp, eax
dec edi
jne 0x4286f2
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp eax, 0xfde8
je 0x4286be
lea ecx, [esp + 0x18]
call fcn.0044861c
lea ecx, [esp + 0x18]
mov dword [esp + 0x130], 0xffffffff
call fcn.00448344
mov eax, ebp
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x42a830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x64]
push ebx
push ebp
push esi
mov esi, ecx
push edi
test eax, eax
mov dword [esp + 0x14], esi
je 0x42aa3e
cmp eax, 0xa
jg 0x42aa3e
cmp eax, 1
jne 0x42a85e
mov ebp, 0x46c844
jmp 0x42a8cc
cmp eax, 2
jne 0x42a86a
mov ebp, 0x46c864
jmp 0x42a8cc
cmp eax, 3
jne 0x42a876
mov ebp, 0x46c884
jmp 0x42a8cc
cmp eax, 4
jne 0x42a882
mov ebp, 0x46c8a4
jmp 0x42a8cc
cmp eax, 5
jne 0x42a88e
mov ebp, 0x46c8c4
jmp 0x42a8cc
cmp eax, 6
jne 0x42a89a
mov ebp, 0x46c8e4
jmp 0x42a8cc
cmp eax, 7
jne 0x42a8a6
mov ebp, 0x46c904
jmp 0x42a8cc
cmp eax, 8
jne 0x42a8b2
mov ebp, 0x46c924
jmp 0x42a8cc
cmp eax, 9
jne 0x42a8be
mov ebp, 0x46c944
jmp 0x42a8cc
cmp eax, 0xa
mov ebp, 0x46c964
je 0x42a8cc
mov ebp, dword [esp + 0x6c]
mov ecx, dword [0x466ff4]
mov dx, word [0x466ff8]
mov dword [esp + 0x18], ecx
mov cl, byte [0x466ffa]
cmp eax, 0xa
mov word [esp + 0x1c], dx
mov byte [esp + 0x1e], cl
jge 0x42a8fa
mov byte [esp + 0x1a], 0x20
add al, 0x30
jmp 0x42a901
mov byte [esp + 0x1a], 0x31
add al, 0x26
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x78], esp
push edx
mov byte [esp + 0x23], al
call fcn.00447f87
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
push 0x78
push 0
push 0
push eax
push ecx
push 0xc
mov ecx, esi
call fcn.00409150
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
xor ebx, ebx
xor ecx, ecx
mov bl, byte [ebp]
mov cl, byte [ebp + 0x14]
mov edx, ebx
mov dword [esp + 0x10], ecx
imul edx, ecx
test edx, edx
stosb byte es:[edi], al
je 0x42aa3e
xor edi, edi
mov byte [esp + 0x20], 0x28
test ebx, ebx
mov esi, 1
jle 0x42a9b9
mov al, byte [edi + ebp + 1]
add esi, 3
mov byte [esp + 0x74], al
mov eax, 0x66666667
mov ecx, dword [esp + 0x74]
and ecx, 0xff
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
add dl, 0x30
mov ecx, 0xa
mov byte [esp + esi + 0x1d], dl
cdq
idiv ecx
add dl, 0x30
inc edi
mov byte [esp + esi + 0x1e], dl
mov byte [esp + esi + 0x1f], 0x2c
cmp edi, ebx
jl 0x42a96d
mov ecx, dword [esp + 0x10]
mov byte [esp + esi + 0x1f], 0x29
mov byte [esp + esi + 0x20], 0x5b
inc esi
xor eax, eax
test ecx, ecx
jle 0x42a9e2
mov dl, byte [eax + ebp + 0x15]
add esi, 2
add dl, 0x30
inc eax
mov byte [esp + esi + 0x1e], dl
mov byte [esp + esi + 0x1f], 0x2c
cmp eax, ecx
jl 0x42a9ca
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
mov byte [esp + esi + 0x1f], 0x5d
mov byte [esp + esi + 0x20], 0x20
inc esi
xor ebp, ebp
test esi, esi
lea edi, [eax + 0x25]
jle 0x42aa3e
mov dl, byte [esp + ebp + 0x20]
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push 1
push edx
call fcn.00442ed8
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0x78
push ebx
push edi
push 0xc
call fcn.00409150
add edi, 6
cmp edi, 0x29f
jle 0x42aa39
mov eax, dword [esp + 0x6c]
add ebx, 0xb
lea edi, [eax + 0x29]
inc ebp
cmp ebp, esi
jl 0x42a9fe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
Function at 0x44c9e1
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x452527
call fcn.00434ba8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044a009
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x4673a0]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], 0x454fd4
call fcn.004480a2
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004480a2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x4be4ee
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x20]
jmp 0x4be4f8
movzx esi, byte [eax + 7]
xchg ebx, edi
lea ebx, [esi + edi]
mov ebp, dword [esp]
mov edi, 0x34b33772
jmp 0x4be56e
add edi, 4
mov dword [edi], edx
pop edi
setg dh
jmp 0x4be546
xor edx, esi
push edi
mov edi, ecx
jmp 0x4be529
movzx edx, byte [eax + 8]
mov edi, dword [esp]
movzx esi, byte [eax + 9]
setno bl
jmp 0x4be591
mov edi, ebp
movzx esi, byte [eax + 0xa]
mov bl, ah
mov bl, pe_nt_image_headers32
inc bl
jmp 0x4be57b
shl edx, 8
mov bh, dh
mov di, word [esp]
bswap edi
jmp 0x4be53f
mov di, 0xb1a2
jmp 0x4be59d
mov bl, 0x8c
bsr edi, eax
shl edx, 8
xor edx, esi
jmp 0x4be556
shl edx, 8
mov edi, 0xf2a61fec
sub esp, 0x14
sub esp, 6
pop dword [esp + 0xf]
jmp 0x4bfbc3

Function at 0x4be6e7
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4be714
xchg bh, bl
mov edi, edx
pushal
setne bl
mov dword [esp + 0xf], ebp
jmp 0x4be745
and edi, esi
pushal
jmp 0x4be76e
bsr bp, di
shr edi, 8
push sp
mov word [esp], bp
lea esp, [esp + 2]
jmp 0x4be72f
lea ebx, [ebx + 0x48bed0]
mov edi, dword [ebx]
pop ebx
jmp 0x4be845
push ebx
mov ebx, edi
lea ebx, [ebx*4]
jmp 0x4be758
mov ebp, ecx
add ebp, 4
mov ebx, dword [ebp]
pop ebp
pushfd
jmp 0x4be7a7
lea esp, [esp + 0x44]
and edi, 0xff0000
push ebp
jmp 0x4be7bd

Function at 0x4beac8
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4bea47
or di, 0x13d1
mov edx, dword [eax + 0xc]
neg cx
mov ecx, edx
mov edi, 0xa1b066f3
jmp 0x4be974
mov eax, edi
neg dx
bswap edx
xchg cx, di
neg dh
jmp 0x4be9a5
mov ebx, 0x48d6d4
lea esp, [esp + 0x30]
jmp 0x480c85

Function at 0x4bebdc
Capabilities:
Encrypt data using aes

Disassembly:
push 0xa
pop eax
bswap ebp
call 0x4bebc3
mov eax, 0x245c8b66
add ch, bl
push ds
sbb dword [edi], 0x9219ea8f
jmp 0x70cdd245
lea esp, [esp + 4]
jne 0x480c85
je 0x4bebb8
lea esp, [esp + 4]
pop edi
mov esi, 0x2947266c
mov ebp, dword [esp]
lea ebx, [esp + 0x420d7f4]
jmp 0x4bec35
mov bh, 0xe2
jmp 0x4bec66
pop esi
mov bp, 0x2365
lea ebp, [ecx*4]
pop ebp
jmp 0x4bec1f
pop ebx
ret

Function at 0x4beefd
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
jmp 0x4bef38
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x48c6d0]
movzx ebx, byte [esi + 5]
call fcn.004bef22
Function at 0x4bf023
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
push ebx
jmp 0x4bf02d
mov ebx, dword [ebx*4 + 0x48bed0]
push ecx
jmp 0x4bf00d
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x48c6d0]
mov ebx, eax
lea ebx, [ecx - 0xdb]
jmp 0x4bf08c
movzx ebx, byte [esi + 9]
call 0x4bf060
mov dword [esi + 4], edi
mov edi, 0x98a4be8a
jmp 0x4bf0c3
lea esp, [esp + 3]
jmp 0x4bf0e8
mov ebx, dword [ebx*4 + 0x48bed0]
mov edi, edx
pushfd
add esp, 1
jmp 0x4bf0ad
lea ebx, [ebx*4]
lea ebx, [ebx + 0x48bed0]
mov edi, dword [ebx]
pop ebx
jmp 0x4bf0f0
shr edi, 0x18
push ebx
mov ebx, edi
jmp 0x4bf0d2
and edi, ecx
mov edi, dword [edi*4 + 0x48c2d0]
jmp 0x4bf161
and ebx, ecx
call fcn.004bf143
xchg word [esp], bx
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xa]
jmp 0x4bf19d
lea edx, [edx + 0x48bed0]
mov ebx, dword [edx]
pop edx
clc
jmp 0x4bf1a9
push edx
mov edx, ebx
lea edx, [edx*4]
jmp 0x4bf187
and ebx, ecx
xor edi, dword [ebx*4 + 0x48c6d0]
bswap ebx
jmp 0x4bf1e9
movzx ebx, byte [esi + 0xd]
call fcn.004bf1d3
jmp 0x4bf21e

Function at 0x4bf1f2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
push ebx
jmp 0x4bf02d
mov ebx, dword [ebx*4 + 0x48bed0]
push ecx
jmp 0x4bf00d
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x48c6d0]
mov ebx, eax
lea ebx, [ecx - 0xdb]
jmp 0x4bf08c
movzx ebx, byte [esi + 9]
call 0x4bf060
mov dword [esi + 4], edi
mov edi, 0x98a4be8a
jmp 0x4bf0c3
lea esp, [esp + 3]
jmp 0x4bf0e8
mov ebx, dword [ebx*4 + 0x48bed0]
mov edi, edx
pushfd
add esp, 1
jmp 0x4bf0ad
lea ebx, [ebx*4]
lea ebx, [ebx + 0x48bed0]
mov edi, dword [ebx]
pop ebx
jmp 0x4bf0f0
shr edi, 0x18
push ebx
mov ebx, edi
jmp 0x4bf0d2
and edi, ecx
mov edi, dword [edi*4 + 0x48c2d0]
jmp 0x4bf161
and ebx, ecx
call fcn.004bf143
xchg word [esp], bx
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xa]
jmp 0x4bf19d
lea edx, [edx + 0x48bed0]
mov ebx, dword [edx]
pop edx
clc
jmp 0x4bf1a9
push edx
mov edx, ebx
lea edx, [edx*4]
jmp 0x4bf187
and ebx, ecx
xor edi, dword [ebx*4 + 0x48c6d0]
bswap ebx
jmp 0x4bf1e9
movzx ebx, byte [esi + 0xd]
call fcn.004bf1d3
jmp 0x4bf21e

Function at 0x4bf2ca
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x4bf2af
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x48bed0]
and edx, ecx
push cx
jmp 0x4bf282
mov edx, dword [edx*4 + 0x48bed0]
jmp 0x4bf357
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x48cad0]
bswap ebx
jmp 0x4bf29e
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x48ced0]
jmp 0x4bf317
and edx, ecx
pushal
lea esp, [esp + 0xa]
lea esp, [esp + 2]
jmp 0x4bf2d9
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
and ebx, ecx
xor edi, dword [ebx*4 + 0x48c6d0]
sub esp, 9
sub esp, 0xb
jmp 0x4bf2ef

Function at 0x4bf911
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
mov dl, byte [ecx + 2]
jmp 0x4bf8fb
Function at 0x4bf954
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4bfa11
call 0x4bfaa5
invalid
cmp dl, 0x2b
call fcn.004bf9cb
test eax, 0x1a826bc8
push 0xef5947c2
mov edi, 0xafbb863b
retf 0xf939
cmp dl, 0x30
jmp 0x4bf9b9
cmp cl, 0x2b
jmp 0x4bfb70
pushfd
jmp 0x4bf976
mov dword [esp + 3], edx
lea esp, [esp + 8]
jb 0x48162a
clc
jmp 0x4bfa42
lea esp, [esp + 0x1c]
cmp dl, 0x39
jmp 0x4bf9e1
jb 0x481610
pushal
pop word [esp + 5]
lea esp, [esp + 2]
jmp 0x4bf9a2
jbe 0x4815c2
ja 0x481610
and ebx, dword [esp + edi*8]
dec dword [ebp + 0xf042464]
test bl, cl
sbb edi, esp
push dword [ebp + 0x2e]
lea esp, [esp + 4]
je 0x4815c2
jne 0x4bfa27
xchg ebx, eax
or ebx, dword [ebx + 0x2eb40dfe]
cmp dword [eax], ebx
jnp 0x4bfa13
test byte [ecx - 0x7f0003e5], bh
cli
das
call 0x4bf9ed
mov cl, byte [ecx + 3]
jmp 0x4bfa67
add ebp, ebx
push ecx
inc edi
rol byte [esi + 0x21], 1
rcl byte [ebx + ebx*8]
dec ebp
frstor dword [edi + edx*2 - 0x4950a31f]
mov eax, dword [0xfa80f9e0]
cmp eax, 0x1af6850f
cld
dec dword [edi]
test byte [ebx + 0x34fffc1b], cl
cmpsd dword [esi], dword es:[edi]
stc
cmp dl, 0x3d
jne 0x481527
je 0x4815c2
xor al, 0xa7
aaa
push edx
mov eax, dword [0xa4b55a6e]
xlatb
cmp dl, 0x7a
cmp dl, 0x7a
jbe 0x4815c2
xchg byte [edi + 0x1b], dh
cld
dec dword [edi]
xchg ecx, ebx
sbb edi, esp
inc dword [eax + 0x7de95af9]
add byte [eax], al
add byte [ecx], dl
mov dword [ecx], ebx
js 0x4bf9e9
ja 0x48162a
cmp cl, 0x5a
jmp 0x4bfad6
cmp dword [ecx + 0x2adfb82a], esi
lcall 0xf41, 0xf98062cb
or byte [edx + 0x73fffc1b], 0xdf
cmp cl, 0x41
jb 0x4815fa
jae 0x4bfa51
xchg dword [0x9027d48d], ebx
imul dword [esi - 4]
wait
jbe 0x4bfa46
inc esi
jno 0x4bfaf2
jbe 0x481656
ja 0x4815fa
lea esp, [esp + 4]
jbe 0x481656
ja 0x48166c
insd dword es:[edi], dx
jl 0x4bfb44
salc
inc ecx
ret
je 0x481656
call 0x4bfb38