joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423743
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4b55d8
call fcn.004a2e80
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00423400
mov al, byte [esi + 8]
lea ecx, [edi + 0xc]
and dword [ebp - 4], 0
mov byte [edi + 8], al
mov al, byte [esi + 9]
mov byte [edi + 9], al
mov al, byte [esi + 0xa]
mov byte [edi + 0xa], al
mov al, byte [esi + 0xb]
mov byte [edi + 0xb], al
lea eax, [esi + 0xc]
push eax
call fcn.00402745
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.00402745
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.00402745
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.00402745
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [edi + 0x48], eax
mov eax, edi
mov dword [edi + 0x4c], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4237e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x4b55d8
call fcn.004a2e80
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.00402798
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402798
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402798
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402798
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4283f7
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x4b5a6a
call fcn.004a2e80
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push edi
mov ecx, dword [esi]
mov dword [ebx], ecx
test ecx, ecx
je 0x42841b
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x42842f
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 8]
mov byte [ebp - 4], 1
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x428443
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 2
mov dword [ebx + 0xc], ecx
test ecx, ecx
je 0x428457
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.004028b8
lea eax, [esi + 0x24]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x24]
call fcn.004028b8
lea eax, [esi + 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x30]
call fcn.004028b8
mov eax, dword [esi + 0x3c]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
add esi, 0x44
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], ecx
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov dword [ebx + 0x70], eax
lea eax, [esi + 0x78]
mov dword [ebx + 0x74], ecx
lea ecx, [ebx + 0x78]
push eax
call fcn.004285dc
lea eax, [esi + 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebx + 0xa8]
call fcn.004285dc
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xdc]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, ebx
mov dword [ebx + 0xdc], ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x428556
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b5a6a
call fcn.004a2e80
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov dword [esi + 0x11], ebx
mov word [esi + 0x15], bx
mov byte [esi + 0x17], bl
call fcn.004029b0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.004029b0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.004029b0
xor eax, eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x78]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
call fcn.00421ec1
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00421ec1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4286e4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b5abd
call fcn.004a2e80
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [edi + 0x14], eax
mov dword [edi], 0x4bc1ac
mov dword [edi + 4], 0x4bc1c0
mov dword [edi + 8], 0x4bc1d4
mov dword [edi + 0xc], 0x4bc1e4
mov dword [edi + 0x10], 0x4bc1f4
mov byte [edi + 0x18], al
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 2
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
call fcn.004029b0
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 3
call fcn.004029b0
lea esi, [edi + 0x60]
mov byte [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00406f52
lea ecx, [esi + 0x28]
call fcn.004029b0
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 5
call fcn.004181dd
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x428795
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b5aef
call fcn.004a2e80
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
lea eax, [esi + 0x10]
push eax
mov dword [edi + 0xc], edx
call fcn.004028b8
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004028b8
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.004028b8
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.004028b8
mov al, byte [esi + 0x48]
mov byte [edi + 0x48], al
mov al, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov al, byte [esi + 0x4a]
mov byte [edi + 0x4a], al
mov al, byte [esi + 0x4b]
mov byte [edi + 0x4b], al
mov al, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov al, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x64]
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], ecx
mov eax, dword [esi + 0x68]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x68], eax
mov al, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x439d62
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b684f
call fcn.004a2e80
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
lea ecx, [esi + 0x1c]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
call fcn.00402798
or dword [esi + 0x28], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov word [esi + 0x38], bx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
inc ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], bl
call fcn.004029b0
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 2
call fcn.004029b0
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov word [esi + 0x80], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 5
call fcn.004029b0
xor eax, eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.0043a03d
lea ecx, [esi + 0xe8]
mov byte [ebp - 4], 8
call fcn.0043a165
xor eax, eax
mov dword [esi + 0x1f0], eax
mov dword [esi + 0x1f4], eax
mov dword [esi + 0x1f8], eax
mov dword [esi + 0x1fc], eax
mov word [esi + 0x200], ax
mov dword [esi + 0x204], eax
lea ecx, [esi + 0x208]
mov byte [ebp - 4], 0xa
call fcn.004029b0
xor eax, eax
mov dword [esi + 0x214], eax
mov dword [esi + 0x218], eax
mov dword [esi + 0x21c], eax
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], 2
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x22c], eax
mov eax, esi
mov dword [esi + 0x228], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43a03d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b68ca
call fcn.004a2e80
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
lea ecx, [esi + 0x14]
mov word [esi + 4], bx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004029b0
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.004143a2
lea ecx, [esi + 0x30]
call fcn.004029b0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x449374
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b7438
call fcn.004a2e80
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], 1
mov word [esi + 0x20], 0x100
mov dword [esi + 0x28], 0x40000000
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
call fcn.004029b0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44b692
Capabilities:
Delete file
Get file size
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x14], ecx
push esi
push esi
test ebx, ebx
mov dword [esp + 0x18], esi
mov ebp, edx
setne al
add eax, 2
push eax
push esi
push 2
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44b770
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
je 0x44b6f6
push 2
push esi
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call ebx
cmp eax, 0xffffffff
je 0x44b770
test ebp, ebp
je 0x44b721
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push esi
push eax
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44b717
cmp ebx, dword [esp + 0x10]
je 0x44b76b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x44b77d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x44b770
mov ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push esi
push esi
adc eax, esi
mov dword [esp + 0x20], ecx
push eax
push ecx
push edi
mov dword [esp + 0x30], eax
call ebx
test eax, eax
je 0x44b770
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x44b770
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x44b770
xor esi, esi
inc esi
jmp 0x44b717
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x44b788
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x44b799
cmp dword [esp + 0x28], 0
jne 0x44b799
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4531c5
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b7438
call fcn.004a2e80
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00453015
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.0045306c
mov al, byte [esi + 0x18]
mov byte [edi + 0x18], al
mov al, byte [esi + 0x19]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov al, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov al, byte [esi + 0x21]
mov byte [edi + 0x21], al
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x34]
mov al, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov al, byte [esi + 0x31]
mov byte [edi + 0x31], al
lea eax, [esi + 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.004028b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x454899
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, edx
cmp esi, 0x200
jb 0x454962
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x454962
mov edx, dword [ecx + 0x3c]
cmp edx, 0x1000
jae 0x454962
lea eax, [edx + 0x200]
cmp eax, esi
ja 0x454962
test dl, 7
jne 0x454962
add edx, ecx
cmp dword [edx], 0x4550
jne 0x454962
movzx eax, word [edx + 4]
sub eax, 0x14c
je 0x45492f
sub eax, 0x74
je 0x454928
dec eax
sub eax, 1
je 0x454928
dec eax
sub eax, 1
je 0x454921
sub eax, 0x3c
je 0x45491a
sub eax, 0x8464
je 0x45492f
sub eax, 0x2400
jne 0x454962
push 0xa
pop ecx
jmp 0x454934
mov ecx, 0x3030401
jmp 0x454934
mov ecx, 0x3030701
jmp 0x454934
mov ecx, 0x3030501
jmp 0x454934
mov ecx, 0x3030103
mov eax, 0x400
cmp word [edx + 0x14], ax
ja 0x454962
movzx eax, word [edx + 0x18]
mov edx, 0x10b
cmp ax, dx
je 0x454957
mov edx, 0x20b
cmp ax, dx
jne 0x454962
mov eax, dword [esp + 8]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x454964
xor eax, eax
pop esi
ret 4

Function at 0x4570d1
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
cmp edx, 8
jb 0x4570f1
mov edi, edx
shr edi, 3
mov eax, dword [ecx + 4]
sub edx, 8
xor eax, dword [ecx]
add ecx, 8
xor esi, eax
sub edi, 1
jne 0x4570df
cmp edx, 4
jb 0x4570fb
xor esi, dword [ecx]
add ecx, 4
and edx, 3
cmp edx, 2
jbe 0x45710e
movzx eax, byte [ecx]
shl eax, 0x10
xor esi, eax
inc ecx
jmp 0x457117
mov eax, esi
mov edi, ecx
cmp edx, 1
jbe 0x457122
movzx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
jmp 0x45712a
mov esi, eax
mov ecx, edi
test edx, edx
je 0x45712f
movzx ecx, byte [ecx]
xor esi, ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x45af91
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4b7f6a
call fcn.004a2e80
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
lea ecx, [edi + 0x30]
mov al, byte [ebx + 0x18]
mov byte [edi + 0x18], al
mov al, byte [ebx + 0x19]
mov byte [edi + 0x19], al
mov al, byte [ebx + 0x1a]
mov byte [edi + 0x1a], al
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
call fcn.00402745
and dword [ebp - 4], 0
lea eax, [ebx + 0x3c]
push eax
lea ecx, [edi + 0x3c]
call fcn.00402745
lea eax, [ebx + 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x48]
call fcn.00402745
lea eax, [ebx + 0x54]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x54]
call fcn.00402745
mov eax, dword [ebx + 0x60]
lea esi, [ebx + 0x68]
mov ecx, dword [ebx + 0x64]
mov dword [edi + 0x64], ecx
mov dword [edi + 0x60], eax
add edi, 0x68
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
lea eax, [ebx + 0x98]
push eax
mov byte [ebp - 4], 3
lea ecx, [esi + 0x98]
call fcn.0045aded
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x463412
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x4b8511
call fcn.004a2e80
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ax, word [esi]
mov word [edi], ax
mov ax, word [esi + 2]
mov word [edi + 2], ax
mov ax, word [esi + 4]
mov word [edi + 4], ax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
lea ecx, [edi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x24]
push eax
call fcn.00402745
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00463219
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46df08
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4b89fa
call fcn.004a2e80
sub esp, 0x14
push esi
push edi
push 2
pop eax
mov word [ebp - 0x14], ax
mov edi, ecx
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
push 0x63
pop eax
mov word [edi + 2], ax
xor eax, eax
mov byte [ebp - 0x12], dl
mov dword [edi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
call fcn.0046eb19
lea ecx, [edi + 0x30]
call fcn.00401999
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 0x30]
call fcn.004639b8
lea ecx, [edi + 0x50]
call fcn.00401999
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 0x50]
call fcn.004639b8
push dword [ebp - 0x1c]
call fcn.004a2e6c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4747e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, ecx
push esi
push edi
cmp dword [eax + 0x34], 0xa
jae 0x474845
nop word [eax + eax]
mov esi, dword [eax]
cmp esi, 8
jae 0x47481d
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x474909
mov dl, byte [ecx]
lea edi, [esi + 8]
inc ecx
movzx edx, dl
mov dword [eax + 8], ecx
mov ecx, 0x18
sub ecx, esi
shl edx, cl
or edx, dword [eax + 4]
jmp 0x474822
mov edx, dword [eax + 4]
mov edi, esi
mov ecx, edx
shr edx, 0x18
shl ecx, 8
mov dword [eax + 4], ecx
lea ecx, [edi - 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x70d6], dl
inc dword [eax + 0x34]
cmp dword [eax + 0x34], 0xa
jb 0x4747f0
movzx edx, byte [eax + 0x70dc]
movzx ecx, byte [eax + 0x70dd]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x70de]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x70df]
shl edx, 8
or edx, ecx
mov dword [eax + 0x70e0], edx
mov cl, byte [eax + 0x70d6]
cmp cl, 0x31
jne 0x47490e
cmp byte [eax + 0x70d7], 0x41
jne 0x4749a4
cmp byte [eax + 0x70d8], 0x59
jne 0x4749a4
cmp byte [eax + 0x70d9], 0x26
jne 0x4749a4
cmp byte [eax + 0x70da], 0x53
jne 0x4749a4
cmp byte [eax + 0x70db], 0x59
jne 0x4749a4
cmp byte [eax + 0x70e8], 0
jne 0x4748dd
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
add dword [eax + 0x70f8], 1
mov byte [eax + 0x70e8], 1
mov ecx, dword [eax + 0x70e4]
adc dword [eax + 0x70fc], 0
rol ecx, 1
xor ecx, edx
mov dword [eax + 0x70e4], ecx
mov dword [eax + 0x30], 2
pop edi
xor eax, eax
pop esi
ret
cmp cl, 0x17
jne 0x4749a4
cmp byte [eax + 0x70d7], 0x72
jne 0x4749a4
cmp byte [eax + 0x70d8], 0x45
jne 0x4749a4
cmp byte [eax + 0x70d9], 0x38
jne 0x4749a4
cmp byte [eax + 0x70da], 0x50
jne 0x4749a4
cmp byte [eax + 0x70db], 0x90
jne 0x4749a4
cmp byte [eax + 0x70e8], 0
jne 0x47495f
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
mov esi, dword [eax + 4]
mov byte [eax + 0x70e8], 1
test esi, esi
je 0x474974
mov byte [eax + 0x70ea], 1
mov edx, dword [eax]
mov ecx, edx
and ecx, 7
mov dword [eax + 0x30], 0xb
sub edx, ecx
shl esi, cl
mov ecx, dword [eax + 0x70e0]
mov dword [eax], edx
mov dword [eax + 4], esi
cmp ecx, dword [eax + 0x70e4]
je 0x474909
mov byte [eax + 0x70e9], 1
pop edi
mov eax, 1
pop esi
ret
Function at 0x483e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
push esi
push edi
mov esi, ecx
lea edx, [esp + 0x20]
push 0x14
mov dword [esp + 0x1c], esi
call fcn.004a2440
lea eax, [esi + 0x80]
push 0x14
lea edx, [esp + 0x64]
mov dword [esp + 0x20], eax
mov ecx, eax
call fcn.004a2440
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xc]
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], esi
jbe 0x483ee7
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x60]
push eax
lea edx, [esp + 0x24]
call fcn.004a2350
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x64]
call fcn.004a2350
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
xor eax, dword [esp + 0x24]
xor ecx, dword [esp + 0x28]
xor edx, dword [esp + 0x2c]
xor edi, dword [esp + 0x20]
xor esi, dword [esp + 0x30]
sub dword [ebp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
jne 0x483e91
mov edx, dword [ebp + 8]
mov dword [edx], edi
mov edi, edx
mov edx, dword [esp + 0xc]
mov dword [edi + 0x10], esi
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8