joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c4b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0040f720
mov dword [esp], ebx
mov dword [esp + 4], eax
mov esi, eax
call fcn.0040fca0
test eax, eax
je 0x42c540
mov edi, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x42c5d0
xor edi, edi
xor esi, esi
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040fef0
mov dword [esp], ebx
call fcn.0040f6d0
test eax, eax
je 0x42c540
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0040f720
mov dword [esp], ebx
mov dword [esp + 4], eax
mov esi, eax
call fcn.0040fca0
mov edi, eax
test eax, eax
je 0x42c5c0
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 0x16
mov dword [esp + 8], str.Intel_Hardware_Cryptographic_Service_Provider
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x42c620
xor edi, edi
xor esi, esi
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040fef0
mov dword [esp], ebx
call fcn.0040f6d0
test eax, eax
jne 0x42c536
mov dword [esp], ebx
call fcn.0040f6d0
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
test eax, eax
jne 0x42c610
xor edi, edi
xor esi, esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
jmp 0x42c51a
lea edi, [esi*8]
jmp 0x42c5f0
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
test eax, eax
je 0x42c660
lea edi, [esi*8]
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
jmp 0x42c5a0
xor edi, edi
xor esi, esi
jmp 0x42c643
Function at 0x43f780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, 0x666e60
push esi
movd xmm0, edi
push ebx
mov ebx, edx
sub esp, 0x5c
mov edx, dword [esp + 0x70]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], edx
mov edx, 0x666e6e
movd xmm1, edx
mov dword [esp + 0x48], 0
xor edx, edx
punpckldq xmm0, xmm1
movq qword [esp + 0x40], xmm0
test eax, eax
jne 0x43f930
test ebx, ebx
je 0x43f890
mov dword [esp + 0x2c], edx
lea ebp, [esp + 0x40]
lea edi, [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x78]
mov esi, dword [eax]
test ecx, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], edx
cmovne edi, ebx
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x87
mov eax, dword [ebp]
mov dword [esp + 4], 0x666e7d
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.004908f0
mov ecx, dword [esp + 0x24]
mov esi, eax
mov dword [ebx], ecx
test eax, eax
je 0x43f867
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x38]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0048d9e0
mov dword [esp], esi
mov dword [esp + 0x24], eax
call fcn.00490000
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x43f94f
add ebp, 4
lea eax, [esp + 0x4c]
cmp ebp, eax
jne 0x43f7df
cmp ebx, edi
jne 0x43f91b
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ebx
lea edi, [esp + 0x40]
lea ebp, [esp + 0x4c]
mov esi, edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x3c]
mov ebx, dword [eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x87
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
mov eax, dword [edi]
mov dword [esp + 4], 0x666e7d
mov dword [esp + 8], eax
mov dword [esp], edx
call fcn.004908f0
mov ebx, eax
test eax, eax
je 0x43f910
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.0048d9e0
mov dword [esp], ebx
mov dword [esp + 0x24], eax
call fcn.00490000
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x43f947
add edi, 4
cmp edi, ebp
jne 0x43f89e
lea edi, [esp + 0x3c]
mov eax, dword [edi]
mov dword [esp], eax
call fcn.004b4820
jmp 0x43f87e
mov dword [esp], eax
call fcn.004b29c0
mov edx, eax
test eax, eax
jne 0x43f7cb
jmp 0x43f87e
mov ebx, dword [esp + 0x2c]
lea edi, [esp + 0x3c]
mov eax, dword [edi]
test eax, eax
je 0x43f980
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004ad550
test eax, eax
je 0x43f980
test ebx, ebx
je 0x43f971
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
jmp 0x43f880
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov dword [eax], esi
jmp 0x43f876
Function at 0x451a70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x74c210]
test eax, eax
je 0x451a80
mov eax, 1
ret
push edi
mov edx, 0x74c080
xor eax, eax
mov ecx, 0x64
mov edi, edx
sub esp, 0x18
mov dword [0x74c210], 1
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
mov dword [esp], 0x202
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
sub esp, 8
test eax, eax
jne 0x451ac0
mov eax, 1
add esp, 0x18
pop edi
ret
call fcn.0049b030
mov dword [esp + 8], str.BIO_sock_init
mov dword [esp + 4], 0x94
mov dword [esp], 0x668670
call fcn.0049b150
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov dword [esp + 8], str.calling_wsastartup__
mov dword [esp + 4], eax
mov dword [esp], 2
call fcn.0049b230
call fcn.0049b030
mov dword [esp + 8], str.BIO_sock_init
mov dword [esp + 4], 0x96
mov dword [esp], 0x668670
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7a
mov dword [esp], 0x20
call fcn.0049b230
mov eax, 0xffffffff
jmp 0x451abb

Function at 0x452090
Capabilities:
Set socket configuration

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x4520d0
xor eax, eax
test ebx, ebx
sete al
add esp, 0x28
pop ebx
ret
call fcn.0049b030
mov dword [esp + 8], str.BIO_socket_ioctl
mov dword [esp + 4], 0xd1
mov dword [esp], 0x668670
call fcn.0049b150
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov dword [esp + 8], str.calling_ioctlsocket__
mov dword [esp + 4], eax
mov dword [esp], 2
call fcn.0049b230
xor eax, eax
test ebx, ebx
sete al
add esp, 0x28
pop ebx
ret

Function at 0x4522a0
Capabilities:
Get socket status

Disassembly:
push esi
push ebx
sub esp, 0x134
mov esi, dword [esp + 0x140]
mov ebx, dword [esp + 0x148]
cmp esi, 0x3f
ja 0x452360
mov eax, 1
test ebx, ebx
jne 0x4522d8
add esp, 0x134
pop ebx
pop esi
ret
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll_time]
mov edx, eax
xor eax, eax
cmp ebx, edx
jl 0x4522c8
mov eax, dword [esp + 0x144]
sub ebx, edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
test eax, eax
je 0x452350
xor ecx, ecx
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
add esi, 1
mov dword [esp + 0xc], 0
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
add esp, 0x134
pop ebx
pop esi
ret
lea ecx, [esp + 0x2c]
xor edx, edx
jmp 0x452318
mov eax, 0xffffffff
jmp 0x4522c8
Function at 0x453670
Capabilities:
Check if file exists

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004cfba0
mov dword [esp + 4], 0x62
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_strchr
cmp eax, 1
sbb esi, esi
and esi, 0x10
add esi, 1
test edi, edi
je 0x4536f8
mov dword [esp], 0x668960
call fcn.0044ba90
mov ebx, eax
test eax, eax
je 0x4537a0
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call fcn.0044bf30
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x6a
mov dword [esp], ebx
call fcn.0044db40
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0049b030
mov dword [esp + 8], str.BIO_new_file
mov dword [esp + 4], 0x43
mov dword [esp], str..._crypto_bio_bss_file.c
call fcn.0049b150
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x668859
mov dword [esp], 2
call fcn.0049b230
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
cmp dword [eax], 2
je 0x453753
call ebx
cmp dword [eax], 6
jne 0x4537b0
call fcn.0049b030
mov dword [esp + 8], str.BIO_new_file
xor ebx, ebx
mov dword [esp + 4], 0x4b
mov dword [esp], str..._crypto_bio_bss_file.c
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 0x20
call fcn.0049b230
jmp 0x4536ea
mov dword [esp], edi
xor ebx, ebx
call sub.msvcrt.dll_fclose
jmp 0x4536ea
call fcn.0049b030
mov dword [esp + 8], str.BIO_new_file
xor ebx, ebx
mov dword [esp + 4], 0x4d
mov dword [esp], str..._crypto_bio_bss_file.c
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80002
mov dword [esp], 0x20
call fcn.0049b230
jmp 0x4536ea
Function at 0x45bdf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp eax, edx
je 0x45be99
mov ecx, ebx
sub ebx, 1
mov esi, dword [eax + 4]
not ecx
and ecx, ebx
mov ebx, dword [edx + 4]
shr ecx, 0x1f
sub ecx, 1
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [eax + 4], esi
mov esi, dword [eax + 0xc]
xor dword [edx + 4], ebx
mov ebx, dword [edx + 0xc]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [eax + 0xc], esi
mov esi, dword [eax + 0x10]
xor dword [edx + 0xc], ebx
mov ebx, dword [edx + 0x10]
xor ebx, esi
and ebx, ecx
and ebx, 4
xor esi, ebx
mov dword [eax + 0x10], esi
xor dword [edx + 0x10], ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jle 0x45be99
mov edi, dword [ebp + 0x14]
mov eax, dword [eax]
mov edx, dword [edx]
lea ebx, [edi - 1]
cmp ebx, 2
jbe 0x45be75
lea ebx, [eax + 0xf]
sub ebx, edx
cmp ebx, 0x1e
ja 0x45bea8
mov edi, dword [ebp + 0x14]
lea edi, [eax + edi*4]
lea esi, cs:[esi]
mov esi, dword [eax]
mov ebx, dword [edx]
add eax, 4
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [eax - 4], esi
xor dword [edx], ebx
add edx, 4
cmp eax, edi
jne 0x45be80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
shr edi, 2
movd xmm5, ecx
mov esi, eax
mov ebx, edx
shl edi, 4
pshufd xmm2, xmm5, 0
add edi, eax
lea esi, [esi]
movdqu xmm3, xmmword [esi]
movdqu xmm0, xmmword [ebx]
add esi, 0x10
add ebx, 0x10
pxor xmm0, xmm3
movdqa xmm1, xmm3
pand xmm0, xmm2
pxor xmm1, xmm0
movups xmmword [esi - 0x10], xmm1
movdqu xmm4, xmmword [ebx - 0x10]
pxor xmm0, xmm4
movups xmmword [ebx - 0x10], xmm0
cmp esi, edi
jne 0x45bec0
mov edi, dword [ebp + 0x14]
and edi, 0xfffffffc
test byte [ebp + 0x14], 3
je 0x45be99
lea ebx, [edi*4]
mov dword [esp + 0xc], edi
lea edi, [eax + ebx]
add ebx, edx
mov esi, dword [edi]
xor esi, dword [ebx]
and esi, ecx
xor dword [edi], esi
mov edi, dword [esp + 0xc]
xor dword [ebx], esi
lea ebx, [edi + 1]
cmp dword [ebp + 0x14], ebx
jle 0x45be99
lea esi, [ebx*4]
lea edi, [eax + esi]
mov dword [esp + 8], esi
add esi, edx
mov ebx, dword [edi]
xor ebx, dword [esi]
and ebx, ecx
xor dword [edi], ebx
xor dword [esi], ebx
mov ebx, dword [esp + 0xc]
add ebx, 2
cmp dword [ebp + 0x14], ebx
jle 0x45be99
mov ebx, dword [esp + 8]
add ebx, 4
add eax, ebx
add edx, ebx
mov esi, dword [eax]
mov ebx, dword [edx]
xor ebx, esi
and ecx, ebx
xor esi, ecx
mov dword [eax], esi
xor dword [edx], ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45c710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov ebx, dword [esp + 0xdc]
mov eax, dword [esp + 0xd0]
mov edi, dword [esp + 0xd8]
mov esi, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 0x1c], esi
call fcn.0045c2d0
test eax, eax
je 0x45c920
lea eax, [esp + 0x30]
mov dword [esp + 0x18], eax
cmp esi, 0x20
ja 0x45c8b0
mov eax, dword [esp + 0xd4]
mov esi, dword [esp + 0x18]
mov edx, dword [ebx]
mov eax, dword [eax]
test eax, eax
cmove eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi]
test eax, eax
cmove eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xd0]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x45c930
mov dword [esp + 0x2c], edx
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor ecx, ecx
lea esi, cs:[esi]
mov edx, dword [esp + 0xd4]
mov eax, ecx
sub eax, dword [edx + 4]
mov edx, dword [esp + 0x20]
sar eax, 0x1f
and eax, dword [edx + esi*4]
mov edx, ecx
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
setb bl
sub edx, dword [edi + 4]
movzx ebx, bl
sar edx, 0x1f
and edx, dword [eax + ebp*4]
mov eax, dword [esp + 0x14]
add edx, eax
mov eax, dword [esp + 0x18]
adc ebx, 0
mov dword [eax + ecx*4], edx
mov edx, dword [esp + 0xd4]
add ecx, 1
mov eax, ecx
sub eax, dword [edx + 8]
shr eax, 0x1f
add esi, eax
mov eax, ecx
sub eax, dword [edi + 8]
shr eax, 0x1f
add ebp, eax
cmp dword [esp + 0x1c], ecx
jne 0x45c7a8
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp + 0xc], esi
mov dword [esp], ebp
call fcn.00586600
mov edx, edi
mov ecx, ebp
lea edi, [edi + esi*4]
sub ebx, eax
lea esi, [esi]
mov esi, dword [ecx]
mov eax, dword [edx]
add edx, 4
add ecx, 4
xor eax, esi
and eax, ebx
xor eax, esi
mov dword [ecx - 4], eax
mov dword [edx - 4], 0
cmp edi, edx
jne 0x45c840
mov eax, dword [esp + 0xd0]
mov edi, dword [esp + 0x1c]
mov dword [eax + 0xc], 0
mov dword [eax + 4], edi
lea edi, [esp + 0x30]
cmp dword [esp + 0x18], edi
je 0x45c899
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x63
mov dword [esp + 4], str..._crypto_bn_bn_mod.c
mov dword [esp], eax
call fcn.004ce2f0
mov eax, 1
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x41
mov dword [esp + 4], str..._crypto_bn_bn_mod.c
shl eax, 2
mov dword [esp], eax
call fcn.004ce330
mov dword [esp + 0x18], eax
test eax, eax
jne 0x45c75b
call fcn.0049b030
mov dword [esp + 8], str.bn_mod_add_fixed_top
mov dword [esp + 4], 0x43
mov dword [esp], str..._crypto_bn_bn_mod.c
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0100
mov dword [esp], 3
call fcn.0049b230
lea esi, cs:[esi]
xor eax, eax
jmp 0x45c89e
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00586600
jmp 0x45c85e
Function at 0x480d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [edx]
mov edi, dword [esp + 0x50]
mov ebx, dword [eax + 0x50]
test ebx, ebx
je 0x480df0
cmp eax, dword [ecx]
je 0x480e38
call fcn.0049b030
mov dword [esp + 8], str.EC_POINT_oct2point
mov dword [esp + 4], 0x72
mov dword [esp], str..._crypto_ec_ec_oct.c
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], 0x65
mov dword [esp], 0x10
call fcn.0049b230
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [eax], 1
jne 0x480d98
call fcn.0049b030
mov dword [esp + 8], str.EC_POINT_oct2point
mov dword [esp + 4], 0x6e
mov dword [esp], str..._crypto_ec_ec_oct.c
call fcn.0049b150
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0101
mov dword [esp], 0x10
call fcn.0049b230
jmp 0x480ddd
mov esi, dword [edx + 0x10]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x480e54
mov esi, dword [ecx + 4]
test esi, esi
je 0x480e54
cmp dword [esp + 0x1c], esi
jne 0x480da0
test byte [eax], 1
je 0x480e90
cmp dword [eax + 4], 0x196
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], edi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], edx
je 0x480eb8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005b0120
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], edi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], eax
mov eax, ebx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00486f30
Function at 0x483240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
mov esi, eax
push ebx
sub esp, 0xbc
mov dword [esp + 0x14], ecx
mov ebx, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test ecx, ecx
je 0x483420
test eax, eax
jle 0x4832b8
mov ecx, pe_nt_image_headers32
lea edx, [esp + 0x2b]
cmp eax, ecx
cmovle ecx, eax
mov dword [esp + 0x18], ecx
cmp ecx, 4
jae 0x4833a0
test ecx, ecx
jne 0x483400
mov eax, dword [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0044c5c0
test eax, eax
jg 0x4832c0
add esp, 0xbc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x670714
mov dword [esp], esi
call fcn.004514a0
test eax, eax
jle 0x4832a7
mov eax, dword [esp + 0x18]
xor ebp, ebp
add eax, 4
mov dword [esp + 0x1c], eax
jmp 0x483324
add ebp, 1
cmp ebp, ebx
je 0x483391
mov dword [esp + 0xc], 0x67071f
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + ebp - 1]
mov dword [esp + 4], 0x670718
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004514a0
test eax, eax
jle 0x4832a7
cmp ebp, ebx
je 0x4833d0
imul eax, ebp, 0xeeeeeeef
cmp eax, 0x11111111
ja 0x4832f0
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x2b], 0xa
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], 0x20202020
lea ecx, [eax - 4]
mov dword [esp + eax + 0x28], 0x20202020
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [esp], esi
mov eax, dword [esp + 0x18]
add eax, 5
mov dword [esp + 8], eax
lea eax, [esp + 0x2b]
mov dword [esp + 4], eax
call fcn.0044c5c0
test eax, eax
jle 0x4832a7
add ebp, 1
cmp ebp, ebx
jne 0x4832fb
mov dword [esp + 0xc], 0x670717
jmp 0x483303
mov eax, ecx
mov dword [esp + 0x2b], 0x20202020
lea edi, [esp + 0x2c]
mov dword [esp + ecx + 0x27], 0x20202020
mov ecx, edx
sub ecx, edi
add ecx, eax
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x48328f
mov dword [esp], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x670721
call fcn.0044c5c0
test eax, eax
setg al
add esp, 0xbc
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
mov byte [esp + 0x2b], 0x20
test cl, 2
je 0x48328f
mov eax, ecx
mov ecx, 0x2020
mov word [esp + eax + 0x29], cx
jmp 0x48328f
add esp, 0xbc
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a0870
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
push ebx
mov ebx, ecx
sub esp, 4
mov edi, dword [esp + 0x18]
test eax, eax
je 0x4a0892
test byte [eax + 0x5c], 2
mov eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmovne esi, eax
mov dword [esp], 0
test edi, edi
jg 0x4a08f1
jmp 0x4a092a
movzx ebp, byte [ebx + 1]
add ebx, 3
shl ebp, 8
or ebp, eax
movzx eax, byte [ebx - 1]
mov ecx, ebp
shr ecx, 0x12
or eax, ebp
shr ebp, 0xc
movzx ecx, byte [esi + ecx]
and ebp, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [esi + ebp]
mov byte [edx - 3], cl
mov ecx, eax
and eax, 0x3f
shr ecx, 6
and ecx, 0x3f
movzx ecx, byte [esi + ecx]
mov byte [edx - 2], cl
movzx eax, byte [esi + eax]
mov byte [edx - 1], al
sub edi, 3
je 0x4a092a
movzx eax, byte [ebx]
mov ecx, edx
add dword [esp], 4
add edx, 4
shl eax, 0x10
cmp edi, 2
jg 0x4a08a8
mov ebp, eax
je 0x4a0940
shr eax, 0x12
movzx eax, byte [esi + eax]
mov byte [ecx], al
mov eax, ebp
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [esi + eax]
mov byte [ecx + 1], al
mov eax, 0x3d3d
mov word [ecx + 2], ax
mov eax, dword [esp]
mov byte [edx], 0
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, eax
shr eax, 0x12
movzx eax, byte [esi + eax]
mov byte [ecx], al
mov eax, ebx
shr ebx, 6
shr eax, 0xc
and ebx, 0x3f
and eax, 0x3f
movzx eax, byte [esi + eax]
mov byte [ecx + 1], al
movzx eax, byte [esi + ebx]
mov byte [ecx + 3], 0x3d
mov byte [ecx + 2], al
mov eax, dword [esp]
mov byte [edx], 0
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a5990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp fcn.004a4ae0

Function at 0x4a59d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp fcn.004a4ae0

Function at 0x4a5a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp fcn.004a4ae0