joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x43894d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f0b90]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x438930
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4389d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x438a01
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x511db8]
test eax, eax
je 0x438a0c
call eax
lea eax, [esi*8]
push eax
call fcn.00435170
mov ecx, dword [0x511dbc]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x438a2d
call ecx
test esi, esi
je 0x4389f8
push dword [ebx + 0xc]
call fcn.00435460
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x50e074]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.004af8a0
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x438b10
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x438a9f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x4f0b90]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x438a82
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x438aea
mov eax, dword [esi]
test eax, eax
je 0x438abd
mov edx, dword [esi + 4]
jmp 0x438abf
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x438aea
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x438adf
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x438b06
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x438b06
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x438afc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x438a76
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x438c84
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x438c74
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f0b90]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x438c54
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x438c86
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.00438b20
add esp, 8
test eax, eax
je 0x438ca0
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x438cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x438d05
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x438cf5
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x4f0b90]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x438cd5
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x438d0a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.00438b20
add esp, 8
test eax, eax
je 0x438d52
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x438d42
push ebx
mov edx, eax
mov ecx, esi
call fcn.00438bd0
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x438df0
push 0x14
call fcn.00435170
mov edi, eax
add esp, 4
test edi, edi
jne 0x438d76
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x438db6
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x438db6
add edx, edx
mov ecx, esi
call fcn.004389d0
test eax, eax
je 0x438db6
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00438920
xor edx, edx
div dword [esi]
jmp 0x438db9
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x438dd7
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.00438960
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x438de6
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a6f0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov dword [ebp - 4], eax
xor esi, esi
mov eax, dword [0x511d88]
push edi
test eax, eax
jne 0x43a727
mov dword [0x511d88], 1
mov ecx, dword [ebp + 0xc]
call fcn.00438fc0
mov edi, eax
test edi, edi
jne 0x43a736
lea eax, [edi + 7]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x43a710
mov ecx, dword [ebp + 0xc]
call fcn.00438e00
jmp 0x43a718
mov eax, dword [0x511d88]
push ebx
test eax, eax
jne 0x43a783
mov dword [0x511d88], 1
lea ebx, [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43a773
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 5
jne 0x43a7bb
inc esi
cmp esi, 5
jge 0x43a7bb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a750
cmp eax, 2
jne 0x43a750
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43a7ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 5
jne 0x43a7bb
inc esi
cmp esi, 5
jge 0x43a7bb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a788
push edi
call fcn.004a85bf
add esp, 4
cmp ebx, 0xffffffff
pop ebx
jne 0x43a7d8
cmp dword [ebp - 4], 2
jne 0x43a7d8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xa0a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43aa50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x110]
mov dword [ebp - 0x118], 0x200
push eax
push 0x104
push edx
push ecx
call fcn.0043a920
add esp, 0x10
test eax, eax
jne 0x43ab79
mov eax, dword [0x511d88]
test eax, eax
jne 0x43aadd
mov dword [0x511d88], 1
lea ecx, [ebp - 0x110]
call fcn.00438fc0
mov esi, eax
test esi, esi
je 0x43ab64
mov eax, dword [0x511d88]
test eax, eax
jne 0x43aaef
mov dword [0x511d88], 1
cmp byte [esi], 0
mov eax, esi
je 0x43ab38
nop
cmp byte [eax], 0x5c
je 0x43ab35
inc eax
cmp byte [eax], 0
jne 0x43aad0
jmp 0x43ab38
cmp eax, 2
jne 0x43aaa0
lea ecx, [ebp - 0x110]
call fcn.00438e00
jmp 0x43aaab
cmp eax, 2
jne 0x43aac8
cmp word [esi], 0
mov eax, esi
je 0x43ab16
lea esp, [esp]
cmp word [eax], 0x5c
je 0x43ab11
add eax, 2
cmp word [eax], 0
jne 0x43ab00
jmp 0x43ab16
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x43ab55
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004a85bf
add esp, 4
test edi, edi
jne 0x43ab79
mov eax, 0x200
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
xor ecx, ebp
pop edi
pop esi
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret

Function at 0x43add0
Capabilities:
Get system information on windows

Disassembly:
xorps xmm0, xmm0
mov dword [0x5242a0], 0
push 0x524280
movdqu xmmword [0x524280], xmm0
movdqu xmmword [0x524290], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.00490b70
test eax, eax
jne 0x43ae55
push esi
cmp dword [0x50e054], eax
jne 0x43ae0e
xor esi, esi
jmp 0x43ae29
push 2
call dword [0x50e090]
mov esi, eax
add esp, 4
test esi, esi
je 0x43ae29
push esi
call dword [0x50e098]
add esp, 4
mov ecx, 0x50df88
call fcn.00434870
mov eax, dword [0x511d8c]
mov dword [0x50df94], eax
mov dword [0x511d8c], ecx
test esi, esi
je 0x43ae51
push esi
call dword [0x50e0a0]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret
Function at 0x43f720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x43f760
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x43f863
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x43f7a0
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.004b4050
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
lea esp, [esp]
test edi, edi
je 0x43f863
mov ebx, dword [edi + 0xc]
cmp ebx, dword [esi + 0x18]
ja 0x43f855
test byte [edi + 0x14], 0x20
jne 0x43f855
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.004b4050
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
cmp ebx, 1
jne 0x43f7e4
mov ecx, edi
call fcn.0043eaa0
mov ecx, dword [esi + 0xa4]
test ecx, ecx
jne 0x43f7f5
mov edx, dword [edi]
mov dword [ebp - 8], edx
jmp 0x43f80e
push 6
push ebx
push dword [edi]
push dword [esi + 0xb0]
call ecx
mov edx, eax
add esp, 0x10
mov dword [ebp - 8], edx
test edx, edx
je 0x43f86c
push dword [ebp - 4]
mov ecx, dword [esi + 0x3c]
push dword [ebp - 0xc]
push dword [esi + 0x80]
mov eax, dword [ecx]
push edx
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x43f83e
mov eax, dword [ebp - 8]
movdqu xmm0, xmmword [eax + 0x18]
movdqu xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x43f846
mov dword [esi + 0x20], ebx
push dword [edi]
mov ecx, dword [esi + 0x58]
mov edx, ebx
call fcn.0044def0
add esp, 4
mov ebx, dword [ebp - 4]
mov edi, dword [edi + 8]
test ebx, ebx
je 0x43f7a0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ee80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test ebx, ebx
jne 0x45ee9f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x50
call fcn.00435760
mov edi, eax
test edi, edi
je 0x45ee96
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.0045e9d0
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.0045eb50
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push 0
push esi
call fcn.0045e750
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.0045e9d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push 0
push esi
call fcn.0045e750
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.0045e9d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.0045ee80
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push 0
push esi
call fcn.0045e750
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push 0
push esi
call fcn.0045e750
mov dword [edi + 0x2c], eax
add esp, 0x10
mov dword [edi + 0x30], 0
mov ecx, 0xfff7
mov dword [edi + 0x34], 0
mov ax, word [ebx + 6]
and ax, cx
mov dword [edi + 0x24], 0
mov word [edi + 6], ax
mov eax, edi
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x466ced
cmp byte [edx], al
je 0x466ce5
inc ebx
cmp byte [ebx], al
jne 0x466ce0
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 4], eax
jle 0x466d8f
mov ecx, edi
cmp edi, 2
jge 0x466d07
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x466d0a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x466d5e
mov edx, ecx
mov ecx, dword [esi + 8]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x466d40
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f0b90]
cmp cl, byte [edx + 0x4f0b90]
jne 0x466d40
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x466d23
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x4f0b90]
movzx eax, byte [eax + 0x4f0b90]
sub eax, ecx
jne 0x466d7f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 8]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00438c30
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x466d8f
jmp 0x466d82
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 4]
jl 0x466cf8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x466e6d
cmp byte [edx], al
je 0x466e65
jmp 0x466e60
inc ebx
cmp byte [ebx], al
jne 0x466e60
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 4]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x466f13
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x466e8d
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x466eeb
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x466ed0
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f0b90]
cmp cl, byte [edx + 0x4f0b90]
jne 0x466ecd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x466eb0
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f0b90]
movzx ecx, byte [ecx + 0x4f0b90]
sub eax, ecx
jne 0x466f00
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.00438c30
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x466f13
jmp 0x466f03
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x466e83
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov dword [esp + 0x28], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
test edx, edx
je 0x46735b
test edi, edi
je 0x46719b
cmp dword [edi + 0x1f8], 0
jne 0x4671aa
mov eax, 0xffff
add word [edx + 0x20], ax
jne 0x46735b
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4672ba
lea esp, [esp]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x30], eax
test edi, edi
je 0x4671d8
cmp dword [edi + 0x1f8], 0
jne 0x467295
mov esi, dword [ebx]
mov ecx, esi
mov dword [esp + 0x28], esi
test esi, esi
je 0x4671fe
cmp byte [esi], 0
je 0x4671f6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x4671f0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x24]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov edx, dword [eax]
mov dword [esp + 0x2c], edx
test edx, edx
je 0x46726b
xor ebx, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
test ecx, ecx
jle 0x467259
mov edi, ecx
mov ecx, esi
jmp 0x467230
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x4f0b90]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x467230
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov eax, ebx
xor edx, edx
div dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
jmp 0x46726d
xor edx, edx
push edx
mov dword [esp + 0x14], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.00438b20
add esp, 8
test eax, eax
je 0x467295
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.00438bd0
add esp, 4
push dword [ebx + 0x1c]
push edi
call fcn.00435500
push ebx
push edi
call fcn.00435500
mov eax, dword [esp + 0x40]
add esp, 0x10
mov dword [esp + 0x18], eax
mov ebx, eax
test eax, eax
jne 0x4671c0
mov ebx, dword [esp + 0x34]
mov ecx, edi
mov edx, ebx
call fcn.004723e0
mov edx, ebx
mov ecx, edi
call fcn.00467100
push dword [ebx]
push edi
call fcn.00435500
push dword [ebx + 0x28]
push edi
call fcn.00435500
mov esi, dword [ebx + 0x1c]
add esp, 0x10
test esi, esi
je 0x4672fe
mov edx, esi
mov ecx, edi
call fcn.0047a790
push esi
push edi
call fcn.00435500
add esp, 8
mov edx, dword [ebx + 0x2c]
mov ecx, edi
call fcn.0045e5f0
test edi, edi
je 0x467315
cmp dword [edi + 0x1f8], 0
jne 0x46731e
mov edx, ebx
xor ecx, ecx
call fcn.004869a0
cmp dword [ebx + 0x3c], 0
je 0x467351
xor esi, esi
cmp dword [ebx + 0x38], esi
jle 0x467345
jmp 0x467330
mov eax, dword [ebx + 0x3c]
push dword [eax + esi*4]
push edi
call fcn.00435500
inc esi
add esp, 8
cmp esi, dword [ebx + 0x38]
jl 0x467330
push dword [ebx + 0x3c]
push edi
call fcn.00435500
add esp, 8
push ebx
push edi
call fcn.00435500
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2670
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x7c08
push eax
call fcn.0049ba50
test eax, eax
jns 0x495a38
lea ecx, [ebp - 0x40]
call fcn.00424920
push str.debuglog.txt
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403c80
add esp, 4
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x4959ed
mov eax, dword [eax]
sub esp, 8
mov edx, str.Failed_to_getValidPort
mov ecx, eax
call fcn.00424590
add esp, 8
cmp dword [ebp - 0x14], 0x10
jb 0x495a10
push dword [ebp - 0x28]
call fcn.004a78e3
add esp, 4
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x495a33
push dword [ebp - 0x40]
call fcn.004a78e3
add esp, 4
or eax, 0xffffffff
jmp 0x495a82
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [edi + 0xd08]
mov esi, eax
push ecx
mov ecx, edi
call fcn.0049aab0
sub esp, 8
mov ecx, edi
push dword [ebp - 0x44]
push esi
call fcn.0049a160
lea eax, [ebp - 0x48]
push eax
push 0
push edi
push 0x495aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xd50], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
Function at 0x495ea0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2708
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x50c7c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
lea edi, [esi + 4]
test ecx, ecx
je 0x495edd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x495eef
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi], 0
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 1
je 0x495f31
push esi
push 0x4eec18
push 1
push 0
push 0x4eec08
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x495f47
mov ecx, dword [esi]
test ecx, ecx
je 0x495f31
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00495d90
mov dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x495f63
mov edx, dword [edx]
jmp 0x495f65
xor edx, edx
mov eax, dword [esi]
push edi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x495f97
call fcn.00495e50
mov dword [ebp + 8], 0
test ebx, ebx
js 0x495f31
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x495fdb
mov eax, dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4